Send most customers a short summary letter: scope, dates, who tested, headline results and remediation status. Share the full penetration test report only when a customer specifically needs it, under confidentiality terms, to named reviewers, and ideally after serious findings are fixed.
Why the full report is a sensitive document
A full pentest report is a map. It lists weaknesses, shows how they were reached, and often includes screenshots, hostnames and payloads. Even a fixed finding can reveal how your system is built. Unfixed findings are worse, because the document becomes a to-do list for an attacker.
That is why handing it to every prospect is a poor default, even though it is tempting when a buyer pushes for proof.
What a summary letter contains
A good summary gives the reader enough to judge your testing without exposing detail:
- The testing company and the date range.
- What was in scope, and what was not.
- The type of test: web application, API, network, cloud configuration.
- The count of findings by severity, and how many are fixed.
- A statement about retest, if one was done.
- A contact for follow up questions.
Many buyers accept this. Their real question is whether an independent party looked and whether you acted on what they found.
Decision guide
| Situation | What to send |
|---|---|
| Early evaluation | Summary letter |
| Procurement review, no special risk | Summary letter plus a short call |
| Regulated or high risk buyer asks directly | Full report, named reviewers, NDA, expiry |
| Findings still open | Summary only, plus remediation plan |
| Customer's own auditor asks | Discuss scope, share the minimum that satisfies the request |
If a customer insists on the full report and you are unsure, offer a supervised read through on a call, where you share your screen and they do not keep a copy.
Prepare the full report before sharing
- Confirm the serious findings are fixed and retested, or note clearly that they are not.
- Remove content that is not needed, such as credentials, internal IP detail or other customers' data.
- Check the testing company's terms. Some reports carry restrictions on redistribution.
- Add an as-of date and a handling line.
- Share through a controlled channel with expiry. See how long a share link should last.
Edits to a report should be redactions of sensitive detail, never changes to findings or severity. If a customer later compares versions, altered findings destroy trust.
What not to do
- Do not paste report excerpts into questionnaire answers without checking they remain accurate.
- Do not describe a pentest as a certification. It is a point in time test.
- Do not send the report as an email attachment to a long distribution list.
To understand how reviewers read these documents, see how to read a penetration test report section by section.
Safeguard offers SBOM and dependency scanning with reachability analysis for continuous coverage between tests, and its compliance and evidence automation can supply current results for your summary. Try a free scan to see sample output.
Quick check
Is a summary letter enough for a security questionnaire?
Usually yes. Questionnaires ask whether you test and fix. A letter with scope, dates and remediation status answers that.
Should you share a report with open critical findings?
Generally no. Share a summary and a remediation plan until the critical items are fixed and retested.
Last reviewed: 19 October 2026.
