One Pentest, Several Reports: Keeping Every Version in Step

Most engagements end in more than one document: the full technical report, a short version for directors or a client’s customers, and later a retest report. Keep them in step by producing every one of them from the same findings, as a different layout, at the time it is sent. The moment a version becomes a copy that somebody edits on its own, the documents start to disagree, and the client notices before you do.

The documents one engagement produces

What a client needs varies, but the same handful of documents comes up again and again:

Document	Who reads it	What it carries
Full report	Engineers and the security team	Every finding in full: evidence, steps to reproduce, remediation, appendices
Executive report	Directors and the board	Scope, the overall picture, the findings that matter in plain words, what to do first
Retest report	The security team, and often an auditor	Each finding’s outcome after the fixes, and what was not retested
Shareable summary	The client’s own customers, or their insurer	What was tested and when, and the outcome by severity, with no detail an attacker could use

A letter of attestation sits beside these rather than among them: a short formal statement that the test took place, which writing an attestation letter an auditor will accept covers.

Why versions drift

Drift starts with a sensible shortcut. The full report is finished and approved, and someone saves a copy, cuts it down to the findings that matter and rewrites them for a director. Then QA changes a rating in the full report, or a client disputes a finding and its title is reworded, and the executive copy still has the old one. A month later the retest report is written from whichever copy was nearest, and now there are three documents with three slightly different versions of the same finding.

Clients compare. An executive report that says four highs beside a full report that says three is the kind of discrepancy that ends in an email from the client’s security lead asking which is right, and the honest answer, that one was edited after the other, does not inspire confidence. Review cannot catch it either, because review checks the document in front of it, not the one sent last week.

One set of findings, several layouts

The fix is to treat each version as a layout, not a document. The findings, their ratings, titles and remediation live in one place, and each version is a template that prints a different selection of them in a different shape:

• Edit the findings, never a version. A rating changed in QA is changed once, in the finding, and every version made after it carries the change.
• Make each version when it is sent. A version produced the day it goes out reflects the findings as they are that day, not as they were when someone saved a copy.
• Let the layout do the cutting. An executive report that prints only the title, rating and a plain summary of each finding above a chosen severity needs no hand editing, and cannot fall behind.
• Keep the numbering the same. Finding numbers that match across every version let a director’s question about one finding be answered from the full report without a lookup table.

What each layout needs from the findings

Layouts that print different things need the findings to hold them. An executive report that prints a sentence of business impact for each finding needs that sentence written, in a field of its own, by the tester who understood it, not composed later from the description. A retest report needs each finding’s outcome and the date it was retested; how to run a retest properly covers what those outcomes should be. A shareable summary needs nothing new, but it does need a decision about what it leaves out, made once in the layout rather than each time by whoever is sending it.

It is the same discipline as keeping the finding form in step with the template, applied to several templates at once: every field a version prints has to be one the testers fill in, with the same meaning everywhere. Your report template should decide your finding fields covers that side of it.

Naming and dating each version

Every version should say what it is and when it was produced: a title that names it, the engagement’s reference, a version number and a date in the document control table. When the full report moves to version 1.1 after a disputed finding is reworded, the executive report produced the same day should carry the same number, so anyone holding two documents can see at once whether they belong together. A filename that carries the client, the engagement, the kind of document and its date does the same job for whoever files them.

When a hand edit cannot be avoided

Sometimes a client asks for a sentence in one version only, or a partner wants a paragraph reworded in their copy. Make that edit last, on the version that is about to be sent, and note it in the document control table. If the change is really about a finding, put it in the finding instead and produce the version again. Editing a pentest report in Word and bringing it back shows how edits made in Word can go back into the findings rather than staying in one file.