Choosing Pentest Reporting Software: 12 Questions to Ask

The best pentest reporting software removes work rather than relocating it. It fills the Word template you already send, reuses findings your team has written before, runs AI on a key or model you control, delivers to clients under your name, and keeps client data where you can say exactly who reads it. The twelve questions below separate tools that save hours from tools that move them, and every answer can be checked in a trial before you pay.

The questions name no vendor, because products change every year and the questions do not. If you are still deciding whether you need software at all, start with how Word and spreadsheets compare with a reporting platform.

Start with where your hours go

Before you look at any software, measure one engagement. Log every hour after the last test day in four buckets: writing what is genuinely new, retyping findings written before, formatting, and chasing review and delivery. The first bucket is what the client pays for. In our experience the other three add up to more, and why the report takes longer than the test breaks them down further.

That log is your benchmark, and it shows when work has only moved: formatting into a template editor only one person understands, review into a comment pane nobody opens, findings into a library that is slower to search than to retype.

Software saves hours when the work stops happening. It moves hours when the same work happens in a new window.

The twelve questions at a glance

Send them to every vendor before any demo, ask for written answers, and keep those answers for renewal.

1. Does it fill your own Word template, or make you rebuild the report in its editor?
2. Do edits made to the generated report in Word come back into the record?
3. Is reusing a library finding faster than retyping it, without the last client's details?
4. Does it score in CVSS 3.1 and 4.0, with the score calculated from the vector?
5. Whose key, which model and whose prompts does the AI use, and can you switch it off?
6. Is QA a workflow with a record, or a habit a busy week can skip?
7. Do clients receive the work under your name: your domain, branding, sign-in and mailbox?
8. Where does client data live, and who at the vendor can read it?
9. What is the platform's own security posture: a second factor for everyone, sessions, secrets?
10. Can you export everything in a usable form and leave without asking anyone?
11. Does the price grow with your firm, or with your clients' activity?
12. Does the trial let you run one real engagement end to end, without a card?

The report: template, edits, reuse and scoring

1. Does it fill your Word template, or replace it?

Your template holds years of decisions about structure, tone and branding, and your clients recognise it. Software that fills it keeps all of that. Software that makes you rebuild the report in its own editor turns reporting into a design project, and the result is usually a near-copy that looks slightly wrong. Ask for a demonstration with your template, fields and sections, not theirs. A good answer maps your placeholders to fields once. A warning sign is "our format follows best practice".

2. What happens when the report is edited in Word?

It will be. The softened sentence for a nervous client, the screenshot moved, the finding withdrawn after a call: the last ten per cent happens in Word. Either the edits are lost from the record, someone retypes them, or the software reads the edited document back in. Only the third keeps the record matching what the client holds, and the retest six months later starts from that record.

3. Is reuse faster than typing?

A findings library survives only if pulling an entry is quicker than writing it, and if saving a good write-up happens from the finding itself. Ask how an entry reaches an engagement, how an improved version replaces the old one, and what stops a previous client's hostnames riding along. Building a findings library your team actually uses covers what belongs in an entry.

4. Which scoring versions, and who does the arithmetic?

FIRST published CVSS 4.0 on 1 November 2023, and many clients still ask for 3.1, so you want both, chosen deliberately rather than mixed by accident. The score should be calculated from the vector, never typed beside it, because a score that disagrees with its own vector is an error a client's reviewer spots in seconds. Classification lists move too: OWASP has published a 2025 Top 10, and a report written against the 2021 list should go on saying so.

AI: whose key, whose model, whose prompts

5. Who runs the AI, and on what terms?

Your clients will ask you this, so ask the vendor first. Does a request run under your own account and provider agreement, or under the vendor's, pooled with every other customer? Can it use a local model on your own hardware, for the client whose contract rules out third-party processing? Can you read and edit every prompt? Does it draft from captured evidence or from a title? Can it be switched off entirely? A vendor's own key puts another company between your client's findings and the model, and you will be explaining that company in every security questionnaire. AI in pentest report writing sets out what it should and should not draft.

Review and delivery under your name

6. Is QA a workflow or a habit?

Review is the step a busy month removes. Ask whether a report can reach a client without approval, whether reviewer comments sit on the finding they concern, whether a reviewer can suggest wording the tester accepts or rejects, and whether the record shows who approved what. If the honest answer is "people know to check", it is a habit.

7. Whose name does the client see?

The deliverable is no longer just the PDF. Ask whether the client portal runs on your own domain, with your logo, colours, fonts and sign-in page; whether single sign-on runs under your own Google or Microsoft application, so the consent screen shows your firm's name; and whether notifications come from your own mailbox. Then ask what clients can do there: download reports, track remediation, request retests. A portal carrying the vendor's name teaches your clients to trust the vendor.

Data, security and the way out

8. Where does client data live, and who can read it?

Your clients' findings are a map of their weaknesses. Get the answer as a place and a mechanism: which country, whose cloud account, and what stops the vendor's staff reading it. "Encrypted at rest" does not answer it, because the vendor holds the keys. The three arrangements are a shared database for every customer, software you host yourself, and a hosted application on a database you own, and self-hosted or cloud pentest reporting compares them. Any of the three can be defended. Not knowing which one you are on cannot.

9. What is the platform's own security posture?

A platform holding many firms' findings is worth attacking. The minimum: a second factor for every user, clients included, through authenticator apps or passkeys; a fresh second factor before sensitive changes; sessions you can list and sign out; AI keys and other secrets stored encrypted; access rules enforced in the database rather than by hiding buttons. Then ask what an attacker would get if the vendor were breached.

10. Can you leave?

Ask what an export contains (findings, evidence, the library, reports as delivered) and in what form: structured data you could load elsewhere, not a folder of PDFs. Ask whether you need the vendor's help to do it. The cheapest time to negotiate leaving is before you join.

Pricing that does not punish growth

11. Does the price grow with your firm, or with your clients' activity?

Every pricing model discourages something. A price that tracks the size of your firm is the least distorting, provided every feature is available at every size. Question the models that charge for activity you want more of:

Ask for the price at twice your current size, and whether anything you rely on today sits in a higher tier.

A trial that tests the right things

12. Can you run a real engagement through the trial?

A trial spent clicking through a demo engagement proves the demo works. Take a recently delivered engagement with sanitised evidence, or the next small one, and in a week:

1. Generate a report from your own Word template.
2. Put your five most common findings in the library and pull them into the engagement.
3. Draft two findings from evidence and check one CVSS 4.0 score against FIRST's calculator.
4. Edit the report in Word and see what happens to the edits.
5. Review it with a colleague: comment, suggest, send back, approve.
6. Invite a test client and look at every screen they see.
7. Export everything and open the export.

Then compare the hours with your benchmark. A trial that needs a card, a sales call or paid onboarding before it starts has already answered question 12.