Penetration test reports with the sign-off built in
Executive summary for the board, findings with evidence for the engineers, retest status, and the client's signed acceptance of the report.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
With QuoteCloud a penetration tester delivers the report as an interactive document: an executive summary, each finding with its rating, evidence and recommendation, the retest status, and the client's legally binding signature accepting the report, with a certificate of authenticity. Comments sit beside the findings, and a retest or fix can be priced in the same document.
Last reviewed by the QuoteCloud team
An exploded engineered drawing of a fictional software company's systems under test, as three stacked plates: 16 external hosts at the bottom, the web app with three role tiers in the middle, and the API ruled with endpoint ticks on top. One green line pins three findings through the layers: 01 critical, 02 and 03 high; at the retest a tick ring lands on each fixed finding. Beside it, four steps (tested 16–27 Nov, report v1.0, retest v1.1, accepted and signed) and the findings card for report NL-PT-2588: account takeover through the password reset (critical), invoices readable by changing an ID, admin panel reachable from the internet (high), all three fixed and verified, and no lockout on the login form (high), fix scheduled. Juno Adeyemi signs: report received and accepted.
The report, page by page
Brightfern Software's web application, API and external test, version 1.1 with the retest: one document for the board and the engineers.
-
Northlatch SecurityPenetration test report NL-PT-2588 Sample · fictional business
Penetration test report
Web application, API & external penetration test
Two weeks of testing against Brightfern's customer web app, its public API and 16 external hosts, from the outside and as three kinds of logged-in user. This version includes the retest of every fix.
Executive summary Tested 16–27 Nov · retested 3 Dec
Drafted by AI · review Summary acceptedOne critical issue let an attacker take over any account through the password-reset flow; it was fixed within two days and the fix held on retest. Of the three high findings, two are fixed and verified, and one (no lockout on the login form) has a fix scheduled for January.
Summary
A summary the board can read
Counts by your rating, the scope and a plain-language summary your lead tester accepted. Your AI assistant can be set up to draft it from the test notes, flagged until a person accepts it.
-
Northlatch SecurityPenetration test report NL-PT-2588 Sample · fictional business
Findings and retest status Rated by the tester; evidence in the appendix
Ref Finding Severity Status Recommendation PT-01 Account takeover through the password-reset flowapp.brightfern.example.com Critical Fixed · verified Single-use, short-lived reset tokens bound to the account. PT-02 Another customer's invoices readable by changing an IDapi · /v2/invoices High Fixed · verified Check ownership on every object request. PT-03 Admin panel reachable from the internetadmin.brightfern.example.com High Fixed · verified Allow the admin panel only from the office and VPN. PT-04 No lockout or rate limit on the login formapp · /login High Fix scheduled Rate-limit by account and address; add a lockout. PT-05 Session stays valid after logoutapp Medium Accepted risk End the session on the server at logout. PT-06 Error pages show stack tracesapi Medium Fixed · verified Return generic errors; log the detail. Findings
Every finding, with its retest status
Fixed and verified, fix scheduled or accepted risk: the status your tester recorded after the retest, beside the recommendation.
-
Northlatch SecurityPenetration test report NL-PT-2588 Sample · fictional business
Evidence · PT-02 Image block · marked up in the image editor
Request
GET /v2/invoices/40418 HTTP/1.11 Host: api.brightfern.example.com Authorization: Bearer •••••••• (customer A)2
Response
HTTP/1.1 200 OK { "invoice": 40418, "customer": "Customer B",3 "total": "1,240.00" }
- 1Invoice ID changed from 40417, customer A's own
- 2Still signed in as customer A
- 3Customer B's invoice comes back
Request and response captured during testing, marked up in the image editor. Fictional host, IDs and figures.
Evidence
Evidence your engineers can act on
Screenshots placed as image blocks and marked up in QuoteCloud's image editor: numbered rings and labels, no separate tool.
-
Northlatch SecurityPenetration test report NL-PT-2588 Sample · fictional business
Comments on this report
- Version 1.1 replaces 1.0: the retest results are in the findings table.
- Accepted risks are recorded in their own signed decision.
Juno AdeyemiPT-04: our lockout change ships on 14 January. Can the retest cover it then?
Felix, NorthlatchYes. We'll retest PT-04 that week and issue version 1.2.
Report received and accepted
Juno Adeyemi · CTO, Brightfern Software
Signed online · 4 Dec, 9:05 am
This report
- Version
- 1.1 · with retest
- Open findings
- 1 high (fix scheduled)
- Accepted risks
- 1 medium
Certificate of authenticity and audit trail attached
Acceptance
Received, questioned, accepted
The CTO asks about the open finding in a comment, then signs that the report was received and accepted, with an audit trail and a certificate of authenticity.
Version 1.0, the retest, and the risk they accepted
A test report has a life after it's sent. Each stage is a document the client can open, comment on and sign.
Executive summary Tested 16–27 Nov
One critical issue lets an attacker take over any account through the password-reset flow; we recommend fixing it before anything else. Three high findings follow: another customer's invoices readable through the API, the admin panel open to the internet and no lockout on the login form.
Findings Rated by the tester; evidence in the appendix
| Ref | Finding | Severity | Status |
|---|---|---|---|
| PT-01 | Account takeover through the password-reset flowapp.brightfern.example.com | Critical | Open |
| PT-02 | Another customer's invoices readable by changing an IDapi · /v2/invoices | High | Open |
| PT-03 | Admin panel reachable from the internetadmin.brightfern.example.com | High | Open |
| PT-04 | No lockout or rate limit on the login formapp · /login | High | Open |
| PT-05 | Session stays valid after logoutapp | Medium | Open |
| PT-06 | Error pages show stack tracesapi | Medium | Open |
The first report: everything open
Sent three days after testing ended, with the critical finding at the top and a summary the board can act on.
- Severity is the tester's rating
- Opens and reading time tracked
- Comments on any finding
Findings and retest status Rated by the tester; evidence in the appendix
| Ref | Finding | Severity | Status |
|---|---|---|---|
| PT-01 | Account takeover through the password-reset flowapp.brightfern.example.com | Critical | Fixed · verified |
| PT-02 | Another customer's invoices readable by changing an IDapi · /v2/invoices | High | Fixed · verified |
| PT-03 | Admin panel reachable from the internetadmin.brightfern.example.com | High | Fixed · verified |
| PT-04 | No lockout or rate limit on the login formapp · /login | High | Fix scheduled |
| PT-05 | Session stays valid after logoutapp | Medium | Accepted risk |
| PT-06 | Error pages show stack tracesapi | Medium | Fixed · verified |
Comments on this report
- Version 1.1 replaces 1.0: the retest results are in the findings table.
- Accepted risks are recorded in their own signed decision.
Juno AdeyemiPT-04: our lockout change ships on 14 January. Can the retest cover it then?
Felix, NorthlatchYes. We'll retest PT-04 that week and issue version 1.2.
The retest is a revision, not a rewrite
Felix updates the statuses in the same report and the client's question about PT-04 is answered in the thread. With version history, both versions are kept.
- Fixed · verified, fix scheduled, accepted risk
- Version history keeps v1.0
- One link for the client
Version history: Business plan
The decision
- Finding PT-05, medium: a session stays valid on the server after the user logs out.
- Brightfern's reason: the fix needs a change to the session store planned for the second quarter.
- Until then: sessions end after 30 minutes without activity, as Brightfern confirms.
- This risk is accepted by Brightfern, not by Northlatch; we'll ask again at the next test or by 30 June.
Risk accepted by
Juno Adeyemi · CTO, Brightfern Software
Signed online · 4 Dec, 9:07 am
This decision
- Finding
- PT-05 · medium
- In place until then
- 30-minute idle timeout
- Review by
- 30 June
Certificate of authenticity and audit trail attached
Accepting a risk is a decision, so it's signed
PT-05 won't be fixed until the second quarter. Brightfern's CTO signs the decision, the interim control and the review date, so it's on record whose call it was.
- The client's decision, in writing
- Signed online, with a certificate of authenticity
- A review date on the page
Your methodology, locked in every report
Testers write findings, not methodology. Put the scope, approach, ratings and limits in a company block and lock it, so every report states them the same way and nobody edits them by accident.
Content locking works at block level: the findings, evidence and summary stay editable for the tester.
- The same method wording in every report
- Ratings explained once
- Limits of a point-in-time test stated plainly
Content locking: Business plan
Cybersecurity templatesMethodology Locked block
- Scope and rules
- Testing stayed inside the targets and window in the signed rules of engagement NL-RoE-0931.
- Approach
- Unauthenticated, then as each of the three user roles; manual testing supported by our usual tools.
- Ratings
- Severity is our rating of likelihood and impact for Brightfern, explained in Appendix A.
- Limits
- A test is a point in time: it shows what we found in the window, not that nothing else exists.
Deliver your next pen test report in QuoteCloud
Free for 14 days, no credit card. Send us a past report and we'll convert it into a template during the trial.
Where the report started
The test it reports on was scoped and signed in QuoteCloud too
Brightfern's proposal priced the test from a scoping sheet, and the CTO signed it and paid half on signing.
Penetration test proposalsFrom the last test day to a signed report
The same order for every engagement.
Write the findings
In your report template: ratings, evidence and recommendations, with the locked method.
Review the summary
Drafted by your tester or your AI assistant, accepted by a person.
Send version 1.0
The client reads it, comments on findings and you reply in the thread.
Retest and revise
Update the statuses; version history keeps the earlier version (Business).
Sign it off
Report acceptance and any accepted risks, each signed online.
Pen test report questions
Why would a client sign a penetration test report?
To record that they received and accepted it, and to own decisions such as accepting a risk. QuoteCloud eSignatures are legally binding, need no account, and come with an audit trail and a certificate of authenticity. Signing accepts the report; it isn't a certification.
How do retests work?
Update the statuses in the same report and send the revised version. With version history on the Business plan, earlier versions are kept. The client keeps one link to the current report.
Can I mark up evidence screenshots?
Yes. Place screenshots as image blocks and mark them up in QuoteCloud's image editor with numbered rings, arrows and labels. Use fictional or redacted data wherever a screenshot could expose something sensitive.
Can I stop testers editing the methodology section?
Yes, with content locking on the Business plan. Lock the methodology block in the template; findings, evidence and the summary stay editable. Locking works per block.
Does QuoteCloud test or verify the findings?
No. QuoteCloud makes the document. The testing, the evidence and the severity ratings are your team's; QuoteCloud presents them, records comments and collects the signature.
Can the client's auditors get a PDF?
Yes. A QuoteCloud document can be saved as a PDF for anyone who needs a file rather than a link.
More for security firms
Scoping, authorising and pricing the work around the report.
-
Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.Explore
-
Authorisation to test & signingRules of engagement and written authorisation signed by every party, then a deposit or full payment on signing.Explore
-
Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.Explore
- AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Reports that end with a signature
Start a free 14-day trial: build your pen test report template with a locked methodology and an acceptance block.