When a Client Disputes a Finding

Every consultancy gets pushback on findings. What separates firms is not how often it happens, it is whether the response is evidence or volume.

A dispute is also information. It usually means the finding was unclear, the severity was unexplained, or somebody internally is being asked to justify why it was not caught. Reading which of those you are in changes the reply.

Three kinds, and they are not the same argument

• Factual: "that is not what our system does". Someone believes the behaviour you described did not happen.
• Severity: "it is real but it is not critical". Nobody disputes the behaviour, only what it is worth.
• Compensating control: "that is mitigated by something you did not see". A claim about the environment rather than the finding.

Answering a severity dispute with more proof of the behaviour, which is the instinctive move, misses the argument entirely and reads as not listening.

The factual dispute is the easy one, if you captured properly

Reply with the request and the response, the timestamp, and the account used. Not a screenshot of a browser window, which proves only that a browser displayed something, but the exchange itself.

If you cannot produce that, the dispute has already told you something worth more than the argument: your evidence capture is not sufficient to defend your own work. Fix that before the next engagement rather than arguing this one harder.

Sometimes the client is right and the behaviour was environmental: a stale cache, a feature flag, a test system that did not match production. Say so plainly and note it in the finding. A finding that turns out to be environment-specific is still worth reporting, with that qualification, because the environment is theirs too.

Severity: separate the base from their environment

Most severity disputes dissolve once the two numbers are separated. The base score describes the vulnerability and does not know their estate. The environmental adjustment is where their context belongs, and it is the part they are entitled to have an opinion about.

"The base vector is what it is; here is what happens to it when we apply the fact that this host is internal only" is a conversation you can have. "It is critical because we scored it critical" is not.

Where you genuinely disagree, record both positions in the finding rather than quietly adopting theirs. A report that says "scored High; the client assesses this as Medium on the basis that the segment is isolated, which we were not able to verify" is more useful to everybody later than one that silently reads Medium.

Compensating controls: test the claim, do not argue with it

When a client says a control elsewhere mitigates the finding, the fastest route is to check, and the offer to check is itself disarming. Often the control exists and does less than believed: a WAF rule that blocks one payload shape, a network restriction that does not apply to the path you used, monitoring that alerts nobody at the weekend.

If the control does what they say, the finding changes and you say so. If it does not, you now have a second finding, and it is one they care about more than the first because they thought they were covered.

Being wrong, quickly and in writing

You will occasionally be wrong. A misread response, a finding that duplicates another, a severity that does not survive your own second look. The instinct is to defend it because the report is delivered and the correction is embarrassing.

Correct it immediately, in writing, with the reason. It costs you one finding and buys you the credibility of every other finding in the document. A firm that has visibly corrected itself once is a firm whose remaining findings a client stops second-guessing.

What to change in the report, and what not to

Change the finding: severity, status, the qualification, the corrected fact. Do not quietly delete a finding that was disputed and stood, and do not soften language to end a conversation. The report is a record of what was true on the date it was written, and a client who later discovers a finding disappeared without a stated reason has learned something about how the record is kept.

Where a dispute changes something, note when and why. The version that goes to an auditor or an insurer should be able to explain its own history.

The dispute that arrives six months later

The hardest dispute is not the one on the delivery call. It is the one that comes from somebody who was never in the room, reading a forwarded report, often with a commercial reason to want a finding to be wrong.

By then the tester has moved on, the environment has changed, and the only thing you have is the document. This is the argument that report quality is actually for. If the finding names the identity used, the timestamp, the exact request, and what was and was not covered, the conversation is short. If it says "we were able to access other users' data", you are relying on somebody's memory of a week six months ago.

Answer these in writing, and answer with the record rather than with a defence of your firm. Where the environment has since changed, say that too: a finding can be simultaneously true on the date it was written and no longer reproducible, and stating both is more credible than insisting on one.

Record the outcome where the next tester will find it

A dispute that ends in agreement produces knowledge, and most firms lose it. The next engagement for that client, often a year later with a different tester, starts the same argument from the beginning.

Write down what was disputed, what the client's position was, what you checked, and what the outcome was. Where a compensating control turned out to be real, that is a fact about their estate worth carrying forward. Where a severity was adjusted for environmental reasons, the reasoning should arrive with the next report rather than being rediscovered.

This is not about being right next time. It is that a client who has to make the same argument twice concludes, reasonably, that nobody was listening the first time.