Full technical report
Scope, dates, methodology, every finding with its CVSS v3.1 score and vector, proof-of-concept evidence, business impact and remediation guidance.
Your auditor and engineering team
Compliance
What auditors receive
Every engagement ends with a set of documents built for the questions auditors, customers and partners ask. Here's what's in the pack, and an example of the letter you can share.
The evidence pack
Five documents, each with a job
Different readers need different detail. The pack gives each of them the right document, so the full report never has to travel further than it should.
Executive summary
Overall risk, findings by severity and status, key themes and strategic recommendations, written for leadership and non-technical reviewers.
Leadership, auditors, customers under NDA
Retest results
An updated report after the included retest, showing which findings are fixed, partially fixed or accepted, with the retest date.
Your auditor
Attestation letter
A one-page, shareable summary confirming what was tested, when and how, and the results after retest, without vulnerability details.
Customers, partners, procurement teams
Engagement records
The agreed scope, written authorisation to test and rules of engagement, so the testing itself is documented and approved.
Your auditor, on request
Example
The attestation letter
A one-page letter you can send to customers and partners. It confirms the test and its results without giving anyone a map of your vulnerabilities.
- What was tested, when, and how much testing
- The standards followed and how findings were rated
- Findings by severity, and what remained open after the retest
- A clear statement of what the letter does and doesn't mean
This example is for a fictional company and shows the format only.
Penetration test attestation
Letter of attestation: Example Company
To whom it may concern,
Rudranetra confirms that it performed a web application and API penetration test for Example Company Ltd between 2 November 2026 and 13 November 2026, comprising 8 tester-days of manual testing.
The assessment covered the following systems:
- app.example.com (Web application)
- api.example.com (REST API)
Testing followed recognised industry standards, including the OWASP Web Security Testing Guide, the OWASP Top 10 and the OWASP API Security Top 10. Findings were rated using CVSS v3.1 and every finding was manually verified.
Rudranetra retested the reported findings on 8 December 2026. The results at that date are summarised below.
| Severity | Identified | Open after retest | Risk accepted |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 0 |
| Medium | 3 | 1 | 0 |
| Low | 1 | 0 | 1 |
As of the retest, Example Company Ltd has no open critical or high-severity findings from this assessment.
This letter summarises the results without disclosing vulnerability details; the full technical report is confidential to the client. A penetration test is a point-in-time assessment of the systems in scope and does not certify that they are free of vulnerabilities.
Rudranetra · Engagement lead
Inside the report
The questions auditors ask, and where the answer is
Whatever the framework, reviewers check the same handful of things. Each one has a clear home in our report.
What exactly was tested, and when?
Engagement details: in-scope assets, exclusions, environment and testing dates.
How was it tested?
Methodology: the standards followed, the testing approach and test coverage by area.
Who tested it, and were they independent?
Document control: prepared by and technical review, by roles independent of your team.
How serious were the findings?
Summary of findings: severity, CVSS v3.1 score and vector for each issue.
Can you show the evidence?
Detailed findings: steps to reproduce, requests and responses, and screenshots.
Were the findings fixed?
Retest summary: the status of every finding at the retest date, plus the remediation roadmap.
Who received the report?
Version history and distribution list.
By framework
What each framework looks for
SOC 2
Penetration testing that gives your SOC 2 auditor clear, dated evidence that your security controls work in practice.
ISO 27001
Penetration testing that supports your ISO/IEC 27001 controls for technical vulnerability management and security testing.
PCI DSS
Internal, external and segmentation penetration testing that meets PCI DSS Requirement 11.4.
HIPAA
Penetration testing that supports your HIPAA Security Rule risk analysis and periodic technical evaluation.
GDPR & DPDP
Security testing that helps you show your safeguards for personal data are tested, under GDPR and India's DPDP Act.
FAQ
Sharing your results
Do we have to give our auditor the full report?
Most auditors ask for the full report, because they need to see scope, method, findings and remediation. They review it under their own confidentiality obligations. Ask your auditor what they need before you share.
What should we share with customers?
Usually the attestation letter, or the executive summary under NDA. Neither discloses how to exploit a vulnerability. Avoid sending the full technical report to customers unless there is a specific need and an NDA in place.
Can the attestation letter be issued before the retest?
Yes, but it then shows findings as open. Most clients wait for the retest so the letter reflects fixed issues. The letter always states the date its results apply to.
Is the attestation letter a certification?
No. It confirms that a penetration test was performed and summarises the results at a point in time. It does not certify that a system is free of vulnerabilities, and no pentest can.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.