A penetration test is a point in time assessment, and therefore it isn’t normally appropriate to issue a certificate relating to the website. However, a statement of works can be provided giving an overview of the penetration testing that has taken place, that can be shared with interested parties.