Reading a penetration test report without panicking
A first pen test report is usually alarming and mostly manageable. How to triage findings by exploitability rather than by the colour of the badge.
The first penetration test report a company receives tends to land badly. There are red items. There are a lot of them. Somebody forwards it to the board.
Having written a number of these reports and helped clients work through others, the most useful thing we can offer is a way to read them.
Severity is not priority
Severity ratings describe the impact if a finding is exploited. They say very little about how likely that is in your specific deployment. A critical-rated vulnerability in a component that is not reachable from the internet and requires an authenticated admin session is a lower priority than a medium-rated flaw in your public login flow.
Ask three questions of every finding: who can reach it, what do they need already to use it, and what do they get. A finding that needs no credentials, is reachable from the open internet and yields customer data goes to the top of the list regardless of its badge colour.
The categories that actually recur
Across assessments, the same handful of issues dominate:
- Access control applied in the interface, not the API. The button is hidden; the endpoint is not. This is consistently the highest-impact category we find.
- Objects addressable by sequential ID with no ownership check, so changing a number in the URL returns somebody else's record.
- Secrets in the repository — usually a
.envcommitted years ago and long forgotten, still valid. - Dependencies years behind, with public exploits available.
None of these are exotic. All of them are fixable in days rather than quarters.
Retest, or it did not happen
A finding is not closed because a developer says it is closed. It is closed when somebody re-runs the original proof of concept and it fails. Build the retest into the engagement from the start — a report full of "remediated" claims with no verification is worth very little to an auditor and nothing to an attacker.
The right emotional response
A first report should be uncomfortable. It is a list of things that were true before anyone looked. The alternative is not having fewer issues; it is not knowing about them.
