How to read a penetration test report

The sections

• Executive summary: overall risk in plain language
• Scope and methodology: what was tested, and what wasn’t
• Findings: description, evidence, risk, fix
• Attack paths: how weaknesses chain together
• Technical appendices

Risk levels

Each finding gets a level (critical, high, medium, low), often based on CVSS, adjusted to your context: a medium flaw on an Internet-facing server can come before a high one on an isolated system.

What to fix first

• Anything critical and Internet-facing
• Anything that’s part of a complete attack path
• Quick fixes that close several findings at once (updates, MFA)
• The rest, scheduled by risk and effort