Sample penetration test report
See what you receive at the end of an engagement before you book one. The two sample reports show how we write up findings, with client details replaced or redacted. Download them, and the questionnaire we use to start an engagement, without filling in a form.
Download the samples
Two sample reports, and the questionnaire we send before a test starts. Each file is a PDF: open it in your browser or save it to share with your team or your auditor.
Web application penetration test report
A grey/black box assessment with one critical, four medium and three informational findings. Every finding has a CVSS score, proof of concept screenshots and a fix.
PDF, 38 pages, 3.7 MB
AWS cloud configuration review report
A white-box review of an AWS account with two medium, four low and four informational findings, from secrets in instance user data to missing logging.
PDF, 18 pages, 1.0 MB
Pre-assessment questionnaire
Not a report: the form we send before a web application or AWS cloud test, so the scope, environments and access are agreed before testing starts.
PDF, 3 pages, 146 KB
Want a report like this for your own system?
The scoping call and the quote are free, and a mutual NDA comes first. Once the scope is signed, testing can start within 48 hours.
What is inside a report
The same structure every time, so a developer, a manager and an auditor can each find what they need.
| Section | What it tells you |
|---|---|
| Your assessment | The URLs or accounts in scope, the test accounts provided, and the constraints of the engagement. |
| Executive summary | Plain-language results for management: how many findings, how serious, and what to fix first. |
| Technical summary | A risk chart and a table listing every finding with its remediation and risk rating. |
| Findings by risk | Each finding gives a description, the impact, every affected URL or resource, proof of concept screenshots, a recommendation and references. Web findings also carry a CVSS 3.1 score and vector. |
| Document control | Who wrote and reviewed the report, and which version you are reading. |
Questions about the reports
To see how the price is set, read what a penetration test costs. For what auditors expect from a report, see testing for compliance.
Are these real client reports?
They show the format and level of detail of a Krylo Security report. Client names, URLs, account identifiers and screenshot details are fictitious or redacted.
Will our report look like this?
Yes. Every engagement ends with a report in this format: a summary for executives, and a detailed section your developers can work from. Ask for a retest when we quote, and we confirm each fix and issue an updated report.
What is the questionnaire for?
It collects the details we need to scope a web application or AWS cloud test: contacts, test windows, environments, authentication, APIs and cloud setup. You can fill it in before the scoping call or during it.
Do we have to share anything to get a quote?
No. The scoping call and the quote are free, and a mutual NDA comes before you share anything sensitive.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.