( security )
What a pentest report should tell your board
Most penetration test reports are written for the engineers who will fix the findings. That is right, but it leaves out the people who decide how much to spend on fixing them.
The one page
- What an attacker could do today, in one sentence
- What it would cost if they did
- The three fixes that remove most of the risk
- How long those fixes take
- When we test again
None of it needs security jargon. If a board member cannot repeat the first line to a client, we rewrite it.
Severity is not priority
A critical finding on a system nobody uses can wait a week. A medium finding on your payment page cannot. We rank fixes by risk and effort together, so the first sprint removes the most danger.
Then we retest and update the same page, so the board sees the risk go down, not just a list get shorter.
