What an engagement report actually looks like.
A redacted PTaaS report from a recent fintech engagement. Every section below is the real template we ship - customer names and payloads redacted.
Report structure
Every report follows the same structure. The shape is a contract - engineers know where to find fix guidance, auditors know where to find control mapping, and leaders know where to find the number that matters.
One-page narrative for leadership and compliance owners. Counts by severity, MTTR trend, top three themes, and the concrete fix plan. Not marketing prose - numbers and decisions.
Every finding has the same shape: title, severity with CVSSv4 + business impact, scope, reproduction steps, PoC, fix guidance per layer (code, config, detection), CWE + CAPEC + ATT&CK, and retest status.
A control-by-control mapping to the framework(s) in scope (SOC 2 TSC, ISO 27001 Annex A, PCI-DSS, HIPAA Security Rule, OWASP ASVS). Your auditor gets the matrix. You get the narrative.
Where applicable - red team and assume-breach engagements - a timelined narrative of the most interesting attack paths discovered, including pivot points and detection opportunities.
After remediation: each finding re-verified. 'Fixed', 'partial', 'not fixed', 'not reproducible anymore'. This is the document your SOC / compliance team actually keeps.
PentStark / sample
Engagement brief
Scope
2 apps · 3 APIs
Window
8 weeks
Status
Retested
Executive summary
01 / 05A concise view of what changed, where risk remains, and what to fix next.
Want the full PDF?
The full redacted sample is 48 pages. We send it over email (PGP-encrypted on request) within one business day. Include your industry in the subject and we'll tune the example to match.
Email me the PDFYour next finding is one scoping call away.
Thirty minutes with a real operator tells us what you need and what we can deliver. No BDR handoff, no sales engineer theater. The person you talk to is the person who scopes the work.