See What a Penva Security Pentest Report Looks Like Redacted Sample, Real Findings

The sample PDF includes: a redacted executive summary (1-2 pages, plain-English), a severity dashboard showing finding counts by severity band, three example findings (one Critical, one High, one Medium) with full writeups including CVSS scoring, CWE mapping, OWASP references and remediation guidance, methodology citation section, appendix structure (showing what’s included without exposing client data), and a CREST-aligned attestation letter. The PDF is approximately 18 pages – roughly half the length of an actual Penva Security report.

The sample is constructed from anonymised material drawn from actual Penva Security engagements. Finding format, severity calibration, CVSS scoring, CWE mapping, methodology citation, and attestation language all reflect real engagement documents. Specific client identifiers, exact financial impact figures, and identifying details have been redacted or generalised. The three sample findings shown are representative of actual finding patterns we identify – not invented scenarios.

Yes – the sample PDF is intended for procurement and security teams evaluating Penva Security as a pentest provider. Sharing it within your organisation is welcome and expected. Public redistribution (posting on a forum, including in a public RFP response, etc.) requires permission – email [email protected] if your use case extends beyond internal evaluation.

Three reasons. First, real client identifiers (URLs, account IDs, business names) are redacted to protect client confidentiality – this is consistent with Penva Security’s anonymous-by-policy approach. Second, full proof-of-concept payloads are summarised rather than published – publishing working exploit payloads against any real system, even an anonymised one, would be irresponsible. Third, exact infrastructure details that could enable identification are generalised to maintain the anonymisation.

Yes, structurally identical. Your engagement report will follow the same template – executive summary, severity dashboard, per-finding writeups with the same metadata structure (ID, severity, CVSS, CWE, methodology reference, proof-of-concept, remediation), methodology citation, appendices, and attestation letter. The content will be specific to your engagement; the structure and quality bar is what the sample demonstrates.

Reports are written by the CREST-certified testers who performed the engagement, not AI-generated. AI accelerates Penva Security’s reconnaissance and coverage phases; it does not write reports. Tester narratives, finding rationales, severity assessments, and remediation guidance all reflect human expert judgment. We use templated formatting for consistency, but the substantive content of every finding is written by the tester who identified it.

PDF is the standard format because most procurement workflows expect PDF deliverables. We can provide the sample in Markdown or HTML format on request – useful if you want to evaluate how the report would integrate with your security tracking tools. For actual engagement reports, we typically deliver PDF (audit format) plus a structured findings file (CSV or JSON) for import into vulnerability-tracking systems.

Yes – the methodology citation section in the sample is identical in structure to what appears in actual reports. It cites OWASP WSTG v4.2 test cases used, PTES phases applied, NIST 800-115 mapping where relevant, the specific scope tested, and the scope excluded with explicit reasoning. Auditors specifically look for this section, and it’s one of the clearest signals separating credible pentest reports from scanner-output documents.

Email [email protected] with your questions, or book a 30-minute scoping call where we can walk through the sample and explain how an engagement specific to your context would differ. Many procurement teams use the sample as a discussion starter with the senior tester who would deliver the engagement – we welcome that conversation.