Not on its own. A penetration test finding count depends on scope, tester skill, time budget, rules of engagement and how findings are grouped. A lower number can mean fewer flaws or a narrower look. Compare tests only when scope and method match, and read severity and repeat findings, not the total.
What a pentest count measures
A pentest is a sample. Testers spend a fixed time attacking a defined scope, and report what they found. Change any of these and the count changes:
- Different tester or firm, with different habits and depth.
- A different time budget.
- Different scope: more or fewer systems and roles.
- Different grouping: ten instances reported as one finding or as ten.
- Different starting access: black box versus credentialed.
- A fix retest included in the count or not.
So "we had forty last year and twenty-five now" tells you little until these are checked. (Those figures are illustrative, not real data.)
Better comparisons
| Compare | Why it is more reliable |
|---|---|
| Repeat findings across tests | Shows whether fixes held and root causes were addressed |
| Time to fix by severity | Measures your response, independent of tester |
| Severity mix on like for like scope | Shows whether serious classes are shrinking |
| Findings by weakness class | Shows systemic patterns |
| Retest pass rate | Shows whether remediation worked |
Repeat findings are the most telling. A flaw that appears in consecutive tests means the fix was local and the root cause stayed.
Structure the comparison
- Record scope, tester, duration, access level and grouping rules for every test.
- Normalise grouping: decide whether to count by instance or by root cause, and apply it to old reports too.
- Compare only like for like scope. Treat new scope separately.
- Track repeat findings and retest outcomes.
- Report time to fix by severity.
- Add what the test could not see: untested areas are part of the result.
The incentive trap
If a team is rewarded for fewer findings, it may narrow scope, shorten the test or argue severity. The Goodhart's law formulation, a measure that becomes a target ceases to be good, applies cleanly. Ask for the count to be reported, never targeted.
Using findings well
The value of a pentest is what you learn and change. For each finding, ask which control should have stopped it and add a test or rule. That becomes your own measure: how many classes of issue now have automated coverage.
What to say in a report
State scope and method alongside the count. Say which findings repeated. List areas not tested. A short, plain statement of limits builds more trust than a falling line.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a lower finding count good news?
Only if scope, tester and method match the earlier test. Check repeats and severity first.
What is the strongest pentest metric?
Repeat findings and retest pass rate, since they show whether root causes were fixed.
Sources
Last reviewed: 19 October 2026.
