Treat it as an exception: keep the tester's original rating, add your own reasoning, get a named approver, set an expiry, and plan a retest. Do not edit or delete the finding from the report. Keep the report intact and attach your decision beside it.
Buyers and auditors often ask for pen test reports and then ask what happened to each finding. "We disagreed" is acceptable. Silence is not.
Separate three situations
Teams use "not fixing" for very different decisions.
| Situation | What it means | Record as |
|---|---|---|
| Disagree with the finding | You believe it is wrong or not exploitable | Dispute, with evidence |
| Agree, risk accepted | It is real and you will live with it for now | Exception |
| Agree, fix deferred | You will fix, but not this quarter | Scheduled remediation with date |
Mixing them makes later review messy. A dispute needs technical evidence. An acceptance needs an approver. A deferral needs a date and an owner.
What the record contains
- Finding reference. Report name, date, finding ID, and the tester's severity.
- Your severity, if different. With the reason, for example an internal-only endpoint.
- Decision. Dispute, accept, or defer.
- Reasoning. Two or three sentences with specifics.
- Other controls. Rate limits, network restrictions, monitoring.
- Approver and date. Someone other than the engineer who owns the code.
- Expiry and retest. Many teams retest at the next scheduled test or after any related change.
Talk to the tester
Send the tester your decision and reasoning before the report is finalized when possible. Some will update the wording. If the report has been issued, ask whether they can add a management response section. A management response is common in assessments and makes your reasoning part of the same document the buyer reads.
Disputing honestly
If you dispute a finding, bring a reproduction or a code reference that shows why it does not apply. A statement like "we think this is low" is a preference. A statement like "this endpoint is bound to a private network and requires a service token, see configuration X" can be checked.
Keep the buyer view in mind
When you share a summary with a customer, the open accepted items matter most. Be ready to explain each in a sentence and to state the review date. If the answer to "when will you look at this again?" is "we will not", rethink the acceptance.
Where Safeguard fits
Safeguard tracks findings from its own scans with owners, statuses and policies. Pen test findings can be referenced alongside them so the decision trail lives in one place.
Try it yourself
Click through it at your own pace, or open it full screen. Follow a finding from detection to a decision and look at which fields record the owner and status.
Quick check
Can I remove a finding from the report?
No. Altering a third party report undermines it. Add a management response instead.
Do accepted pen test findings need an expiry?
Yes, as with any exception. Tie it to the next test or a fixed date.
Last reviewed: 19 October 2026.
