Arian Mosallah
Founder and Technical Director, Pental. Practising penetration tester, OSCP, CRT.
Arian Mosallah is the founder and Technical Director of Pental, and a practising penetration tester in the UK. He holds the Offensive Security Certified Professional (OSCP) and CREST Registered Penetration Tester (CRT) certifications.
He tests client applications and infrastructure for a living, and built Pental for the part of the job that comes after the testing: writing findings, reviewing reports, delivering them under a firm’s own name and following each finding through to its retest.
He writes Pental’s guides, posts and comparisons from that work, and the product decisions they describe are his.
Guides for the Work
Templates and references for the documents around a test and for writing up findings, and 40 more guides to setting up and running Pental.
The Pental API: Connect Your Pentest Data to Your Own Tools
The Pental API reads and changes engagements, findings, clients and comments from your own scripts and systems, in the Portal and in our free reporting tool: keys, signing in, every function, and the limits.
Converting a Ghostwriter or PwnDoc Word Template
Bring the Word template your reports come out of across from Ghostwriter or PwnDoc: where to put it, what each placeholder becomes, what has no equivalent, and the finding fields it adds.
Penetration Test Report Template: Free Word Download
A free penetration test report template in Word, ready for CVSS 4.0, with one finding written out in full. Every section and every field is explained below, with what a good one looks like.
How to Write a Penetration Test Report, Step by Step
The process from first note to delivery: set the report up before testing, write findings as you confirm them, score severity with reasons, write the summary last, and QA everything before it leaves.
Penetration Testing Severity Levels and Risk Rating Matrix
Critical, high, medium, low and informational defined in one table and mapped to CVSS 4.0, with a likelihood and impact matrix for findings CVSS does not fit, and the habits that keep testers consistent.
CVSS 4.0 Examples: 15 Common Pentest Findings Scored
Fifteen findings you raise in almost every test, each scored in CVSS 4.0 with a full vector and the reasoning behind it, set beside its 3.1 score so you can see exactly where the two versions part company.
Common Penetration Test Findings and How to Write Them Up
The 27 findings that recur in almost every infrastructure, Active Directory, web, cloud and API test, what to say about each, and how to write each one once so it is reused.
Vulnerability Remediation Timelines: A Defensible SLA Table
Remediation timelines by severity for penetration test findings, checked against Cyber Essentials, the NCSC’s timescales, PCI DSS v4.0.1 and DORA, with exceptions, risk acceptance and how a retest proves the clock.
Penetration Testing Scoping Questionnaire: Free Template
A scoping questionnaire split by test type, with the questions that move an estimate and why. Web, API, infrastructure, cloud and mobile, plus a table turning answers into rough day counts. Free Word template included.
Penetration Testing Statement of Work: Template and Clauses
A statement of work turns a penetration test into an agreement: scope, assumptions, deliverables, retests, liability and data handling. The clauses that matter, wording that cannot be read two ways, and a UK template.
Penetration Testing Rules of Engagement: Template and Guide
Rules of engagement are the operating agreement for one penetration test: what may be touched, when, how far a tester may go, and who is called when something breaks. Every clause one needs, with a free Word template.
Penetration Test Authorisation Letter: A UK Template
The authorisation letter is the client’s written permission to test, and under the Computer Misuse Act 1990 it keeps the work lawful. Who can sign it, what it must name, third-party assets, and a free UK template.
Cloud Penetration Testing Rules: AWS, Azure and Google Cloud
Do you need permission to test AWS, Azure or Google Cloud? Each sets its own rules. The three side by side, as of October 2026: what needs no approval, what is prohibited, and what belongs in your RoE.
OWASP Top 10 2025 vs 2021: What Changes in Your Reports
The OWASP Top 10 2025 set against 2021 in one table, what moved and why, the two new categories, where SSRF now sits, and how to re-map a findings library and report templates without breaking older reports.
Penetration Testing Glossary: 60 Terms Defined
Plain, quotable definitions of the terms people meet in penetration test scopes, reports, retests and schemes, grouped so you can point a client at the one they asked about.
Posts
On testing, reporting and running a consultancy, newest first. The blog.
Pentest Reporting for Freelance Penetration Testers
Freelance pentesters report well alone with one findings library, a written CVSS position, the client's template, self-review and evidence deleted on time.
Tracking Pentest Findings in a Spreadsheet, and When to Stop
Track pentest findings in Excel or Google Sheets with a fixed ID, CVSS vector, owner, target date and retest result on every row, and know when to stop.
Screenshots in Pentest Reports: Captions, Redaction and Size
Screenshots in a pentest report should each prove one point: cropped, redacted by removing the data, captioned with what they prove, numbered and kept small.
Stopping AI From Inventing Findings in Pentest Reports
How to stop AI inventing versions, CVEs, hosts and impact in pentest findings: draft only from captured evidence, keep values verbatim, and review every draft.
Two Testers, One Pentest Report: Writing Without Overwrites
Several testers can write one pentest report at once when each finding has one owner, severity rules are agreed and everyone writes into one source of truth.
Markdown or Word for Pentest Reports: What Each Costs You
Markdown or Word for pentest reports: what each costs in writing, review, layout, version control and client edits, plus a third option and how to choose.
Why the Report Takes Longer than the Test, and What Actually Fixes It
Why the pentest report takes longer than the test: where the days after testing go, which of them are real work, and the changes that recover most of the time.
PTaaS for Pentest Firms: What It Means and How to Sell It
PTaaS is a delivery model, not a new kind of testing. What clients mean by it, what a consultancy must change, and how to price it and sell it under your brand.
Choosing Pentest Reporting Software: 12 Questions to Ask
Twelve questions that separate pentest reporting software that saves hours from software that moves them, from your Word template and AI key to data and price.
Pentest Report Automation vs Word: A Fair Comparison
Pentest report automation against Word templates and spreadsheets: what Word does well, where the hours go, and a costed example for a four-tester firm.
Starting a Penetration Testing Company in the UK
Starting a penetration testing company in the UK: the company, insurance, authorisation paperwork, the certifications buyers ask for and a report worth sending.
AI in Pentest Report Writing: A Policy Clients Will Accept
AI in pentest report writing: what it should draft, what counts as client data, local model or your own key, and a one-page usage policy clients will accept.
Free Tools
Calculations a testing firm makes every week, free in the browser. All the tools.
CVSS 4.0 and 3.1 Calculator
Score a vulnerability in CVSS 4.0 or 3.1, read a pasted vector, share the result as a link, or score a whole list of vectors at once.
Penetration Test Quote Calculator
Size a penetration test from typical days per test type, with its own reporting and retest days, then price it at your day rate and copy the days table into your quote.
Vulnerability Remediation Deadline Calculator
Turn a list of findings into fix-by dates: by severity from the day the client is told, and for missing updates from the vendor’s release, as the NCSC and Cyber Essentials set them.
OWASP Risk Rating Calculator
Rate a finding with the OWASP Risk Rating Methodology: likelihood and impact from sixteen factors, the overall severity from its matrix, and the vector to quote in a report.