Share a short summary letter, not the full report. A good summary names the tester, dates, scope, method and the number of findings by severity, and confirms that critical and high findings were fixed and retested. The full report stays private because it maps your weak points.
What buyers want to know
When a buyer asks for a penetration test, they usually want to know three things: that an independent party tested, that the test covered the product they will use, and that serious issues got fixed. A summary can answer all three.
What goes in a summary letter
- Tester. The firm or the independent team.
- Dates. When testing started and ended, and when retest happened.
- Scope. Which applications, APIs and environments were tested, and what was excluded.
- Approach. Black box, grey box or white box, and whether authenticated testing was done.
- Result. Counts by severity, with a plain statement of the status of each critical and high finding.
- Attestation of retest. Whether fixes were verified.
Ask your tester to produce the letter. A letter on the tester's letterhead carries more weight than your own paraphrase.
What stays out
Exploit details, hostnames, internal network layouts and anything that would help an attacker. If a buyer demands the full report, offer a screen share with a security lead, or a read only review under NDA, rather than a file transfer.
Frequency and scope
Buyers often ask for a test within the last twelve months. Do not promise a cadence you will not keep. If you test annually and after major releases, say that. If you test less often, say so, and describe what runs between tests, such as scanning and code review.
Fix before you share
A summary showing open criticals invites follow up. Retest, close and then share. If something is open for a good reason, describe the compensating control honestly.
Link evidence to questionnaire answers
Questionnaire rows about testing should point to the same letter. See building an answer library. One letter, many answers, fewer inconsistencies.
Quick check
Does a vulnerability scan count as a penetration test?
No. Scans find known issues automatically. A penetration test involves a person attempting to exploit weaknesses and chain them. Describe each accurately.
Can we name the tester?
Usually yes, if your contract with them permits it. Check before publishing.
Last reviewed: 19 October 2026.
