CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries when we checked on 18 October 2026, with the latest additions dated 16 October. A useful penetration test report lets you check any CVE it cites against a list like that. A weak one hands you a pile of scanner output and a logo.
You can tell the difference before you pay. Ask for the report outline and a sample with the client name removed.
What's affected
Every buyer of a penetration test, and every reviewer who later reads yours. The PCI Security Standards Council guidance is blunt: merely reporting lists of vulnerabilities is not helpful and does not meet the intent of a test. The report should clearly communicate what was tested, how it was tested and the results.
Its suggested outline, which is a sensible contract checklist for any engagement:
- Executive summary of scope and major findings.
- Statement of scope, naming the systems tested.
- Statement of methodology.
- Statement of limitations, such as testing hours, bandwidth limits and legacy system restrictions.
- Testing narrative, including problems met during testing.
- Findings: how each can be exploited, severity, affected targets and references such as CVE and CWE.
- Tools used.
- Cleanup instructions, including test accounts and records to remove.
What to do now
- Put the outline above in the statement of work as the required report structure.
- Require that severity ranking is explained. The guidance says the report should document how it was derived, with traceable reasoning if the tester adjusts a standard score.
- Require findings that were not exploited but still matter. The guidance says to include them.
- Require reproduction steps and evidence for every finding, so your engineers can verify and fix.
- Ask for a retest report format now: original findings, original test date, retest date and results.
How to avoid this trap
- Reject sample reports that are mostly tool output. If every finding is a CVE copied from a scanner, you bought a scan.
- Check that the tester names limitations. A report with none is worth a question.
- Do not accept a report without a scope section. Reviewers read that first.
Quick check
What should a finding include besides a title?
How it can be exploited, its severity and how that was derived, the targets affected, references such as CVE or CWE, and enough evidence to reproduce it.
