Pentest Reporting for Freelance Penetration Testers

Freelance penetration testers handle reporting on their own by keeping one findings library and one written scoring position across every client, writing in whichever template the client or the hiring consultancy requires, reviewing each report against a checklist after a night away from it, and deleting client evidence on a date agreed before testing. With no colleague to catch the mistakes, the routine has to catch them instead.

Many clients, and other people's templates

A freelancer's reports go out under two names. Work you win yourself goes out in your own template under your own name. Work you take as a subcontractor usually goes out in the hiring consultancy's template under theirs, and their client may never know you were involved. The consultancy's side of that arrangement is in subcontracting a test and keeping the report yours. From your side, ask for these before the first day of testing:

• The template, as a Word file, and an example finding written in it, so you can see how a finished one reads.
• Their severity scale and CVSS version, and whether they apply environmental metrics.
• Their house wording, if they keep a findings library, and whether they expect it used.
• How they want evidence: screenshots, request and response pairs, or both.
• Who reviews the draft, by when, and where it goes. A draft goes to the consultancy, not their client, unless they tell you otherwise in writing.
• What happens to your notes and evidence afterwards, and by what date.

Keep each consultancy's template and wording apart from your own and from every other firm's. The mistake that ends a subcontracting relationship fastest is a report for one firm's client that carries another firm's name, wording or hostnames.

A findings library that travels between clients

A library matters more to a freelancer than to a firm, because there is nobody to ask how the weakness was written up last time. Build it from real reports rather than as a project: when you write a description or a remediation you are pleased with, save it then, stripped of hostnames, screenshots and account names. Write entries in neutral language, so they sit equally well in your report or a consultancy's, and keep a default CVSS vector on each, so the score travels with the wording.

One habit is particular to freelancing: know which entries are your own work. Wording written under a contract that gives the content to the consultancy is theirs, and it should not reappear in a report for somebody else. Check what each agreement says before anything written under it goes into your library.

Consistent CVSS without a second opinion

In a firm, inconsistent scoring is caught by a colleague in review. Alone, it is caught by a client who compares two of your reports. Three habits stand in for the colleague.

1. Write your scoring position down. One page: the CVSS version you use, how scores map to your severity levels, when a chain becomes its own finding and when you apply environmental metrics. When a consultancy's scale differs, keep the vector and translate only the label.
2. Score the vector before you write the prose, then check that the description supports every metric in it.
3. Compare with yourself. Before a score is final, look at the default vector in your library entry or the last time you rated the same weakness, and either match it or write down why this instance differs.

The common errors, from scoring effort as complexity to a label that disagrees with its vector, are set out in CVSS scoring mistakes in pentest reports.

Reviewing your own report

Self-review is weaker than a second reviewer, and it catches far more as a separate step with its own checklist than as a last read before sending. The most useful ingredient is time. Finish the draft, stop, and review it the next morning: an author rereading straight away sees what they meant rather than what they wrote. Then read it in a different form from the one you wrote it in, such as a PDF on a tablet or a printout, and work through the list in order.

1. Client name, scope, dates and version on the cover and in every header, then a search of the whole document for your previous client's name and any other consultancy's.
2. Every finding against its evidence: the steps reproduce, the affected assets are complete and the vector matches what you observed.
3. Severity labels that match their scores, and summary counts that match the findings.
4. Remediation that tells the person fixing it what to change.
5. Evidence with no live credentials, session tokens or another client's hostnames, and no more personal data than the finding needs.
6. The file itself: tracked changes resolved, comments removed, and document properties that name the right firm. Word's Document Inspector finds most of what hides there.

A review swap with another independent tester under a mutual NDA, the arrangement starting a penetration testing company suggests for a first sample report, beats any checklist. For a client's report, do it only with the client's or the consultancy's agreement.

Holding client evidence, and deleting it

A freelancer's evidence tends to spread across more places than a firm's: the testing laptop, virtual machines and their snapshots, a cloud server used for external testing, proxy project files, and the email that carried a draft. The handling rules are the same as anywhere, and handling evidence and client credentials safely sets them out. What changes when you work alone is that nobody else will run the deletion.

• Agree the date before testing. For direct work, put the period in your terms. For subcontracted work, the consultancy's agreement decides, and it may ask for material back rather than deleted.
• Keep one encrypted folder per engagement, so deleting it is one decision rather than a search.
• List every place a copy went, snapshots, testing servers, chat and sent mail included, and delete from each.
• Remember backups. Deleting the working copy leaves it in every backup until that backup expires, so know when yours do.
• Record it. Send the client or the consultancy a dated note of what was deleted and from where.

Data protection law adds duties of its own, and this is not legal advice: check your contracts, and take advice on what applies to you.

Delivery

For direct clients, agree at booking who receives the report and how, so the final version does not go to whoever sent the last email. Send one version marked final, keep a record of what went to whom and when, and if a correction follows, issue a new version with a note of what changed. On subcontracted work, delivery belongs to the consultancy: the draft goes to them, in their format and by their route, and anything you tell their client about a finding goes through them too.

What tooling costs a one-person business

The cash is the smaller part of the cost and the hours are the larger. Word and a spreadsheet cost almost nothing beyond a licence you already pay for, and the time goes on formatting, copying findings between documents and keeping several templates working. A hosted reporting platform removes much of that for a fee per person. A self-hosted open-source tool removes the licence fee and gives you a server to look after, which what open-source pentest reporting costs counts in hours. Three questions settle it for one person:

• Can it fill someone else's template? If much of your work is subcontracted, a tool that only produces its own format adds a step rather than removing one.
• Where does client data live, and where does it go? A consultancy may ask you the same supplier questions its clients ask it, including where AI sends evidence.
• What is an hour of yours worth? Divide your day rate by the hours in your day, and count the hours each option takes over a year.