What an engagement report actually looks like.
A redacted PTaaS report from a recent fintech engagement. Every section below is the real template we ship — customer names and payloads redacted.
Report structure
Every report follows the same structure. The shape is a contract — engineers know where to find fix guidance, auditors know where to find control mapping, and leaders know where to find the number that matters.
One-page narrative for leadership and compliance owners. Counts by severity, MTTR trend, top three themes, and the concrete fix plan. Not marketing prose — numbers and decisions.
Every finding has the same shape: title, severity with CVSSv4 + business impact, scope, reproduction steps, PoC, fix guidance per layer (code, config, detection), CWE + CAPEC + ATT&CK, and retest status.
A control-by-control mapping to the framework(s) in scope (SOC 2 TSC, ISO 27001 Annex A, PCI-DSS, HIPAA Security Rule, OWASP ASVS). Your auditor gets the matrix. You get the narrative.
Where applicable — red team and assume-breach engagements — a timelined narrative of the most interesting attack paths discovered, including pivot points and detection opportunities.
After remediation: each finding re-verified. 'Fixed', 'partial', 'not fixed', 'not reproducible anymore'. This is the document your SOC / compliance team actually keeps.
═══════════════════════════════════════════════PentStark · Engagement ReportCustomer: Acme (redacted)Window: 2026-01-03 → 2026-02-28Scope: 2 apps · 3 APIs · 1 AWS account═══════════════════════════════════════════════§ Executive summary• 4 criticals · 6 highs · 12 mediums · 18 lows• Mean time to remediate: 4.2 days• Regression rate on retest: 0%• SOC 2 TSC evidence package: attached§ Findings indexPS-1142 CRIT BOLA in /v2/orgs/:id/invoicesPS-1141 CRIT AD CS ESC1 — 'User' templatePS-1138 HIGH SSRF → IMDSv1 → prod-s3-readPS-1129 HIGH OAuth redirect_uri allowlist bypass...§ MethodologyPTES · OWASP WSTG · OWASP ASVS L3 · MITRE ATT&CK§ AppendicesA. Finding catalog (per-bug PoCs + fix guidance)B. SOC 2 control-mapping matrixC. MITRE ATT&CK coverage heat-mapD. Retest delta (pre-fix vs. post-fix)
Want the full PDF?
The full redacted sample is 48 pages. We send it over email (PGP-encrypted on request) within one business day. Include your industry in the subject and we'll tune the example to match.
Email me the PDFYour next finding is one scoping call away.
Thirty minutes with a real operator tells us what you need and what we can deliver. No BDR handoff, no sales engineer theater — the person you talk to is the person who scopes the work.