The detail in pen test reports should include:
All risks based on the current server/application setup/configuration
Vulnerabilities and running services for the servers and applications
What has been done to exploit each security issue
Remediation steps
Near-term and long-term actions
Vulnerabilities that cannot be exploited must also be included in the final report
It’s a good idea to seek a sample report before engaging a pen test provider – this way you’ll know what you can expect to receive. If a report is full of jargon and difficult to decipher, its use to you is limited. Defense.com follows best–practice standards for undertaking a pen test, including OWASP and PTES.