Pentest Guides, Templates and References.
Free Word templates for the documents around a test, reference pages for writing up and scoring findings, and step-by-step guides to setting up and running Pental: your database, your domain, your email, your AI and the portal your clients use.
Start here
The setup guide, start to finish
The fastest way through everything below: registering, your own domain, your own database in any of three places, your own mail server, branding, the first sign-in, updating the database on Supabase Cloud, and moving the database if you change your mind.
- 0:00 · Registering, signing in, and the free trial
- 0:44 · Your name and your firm’s name
- 0:50 · Custom domain
- 1:35 · Your own database, three ways
- 5:45 · Your own email server
- +4 more
Templates
Free Word templates for the documents around a test, each with guidance on filling it in and adapting it to your own firm.
Converting a Ghostwriter or PwnDoc Word Template
Bring the Word template your reports come out of across from Ghostwriter or PwnDoc: where to put it, what each placeholder becomes, what has no equivalent, and the finding fields it adds.
Penetration Test Report Template: Free Word Download
A free penetration test report template in Word, ready for CVSS 4.0, with one finding written out in full. Every section and every field is explained below, with what a good one looks like.
Penetration Testing Scoping Questionnaire: Free Template
A scoping questionnaire split by test type, with the questions that move an estimate and why. Web, API, infrastructure, cloud and mobile, plus a table turning answers into rough day counts. Free Word template included.
Penetration Testing Statement of Work: Template and Clauses
A statement of work turns a penetration test into an agreement: scope, assumptions, deliverables, retests, liability and data handling. The clauses that matter, wording that cannot be read two ways, and a UK template.
Penetration Testing Rules of Engagement: Template and Guide
Rules of engagement are the operating agreement for one penetration test: what may be touched, when, how far a tester may go, and who is called when something breaks. Every clause one needs, with a free Word template.
Penetration Test Authorisation Letter: A UK Template
The authorisation letter is the client’s written permission to test, and under the Computer Misuse Act 1990 it keeps the work lawful. Who can sign it, what it must name, third-party assets, and a free UK template.
Reference
Reference pages for writing up and scoring findings, and for the rules and standards a test has to work within.
The Pental API: Connect Your Pentest Data to Your Own Tools
The Pental API reads and changes engagements, findings, clients and comments from your own scripts and systems, in the Portal and in our free reporting tool: keys, signing in, every function, and the limits.
How to Write a Penetration Test Report, Step by Step
The process from first note to delivery: set the report up before testing, write findings as you confirm them, score severity with reasons, write the summary last, and QA everything before it leaves.
Penetration Testing Severity Levels and Risk Rating Matrix
Critical, high, medium, low and informational defined in one table and mapped to CVSS 4.0, with a likelihood and impact matrix for findings CVSS does not fit, and the habits that keep testers consistent.
CVSS 4.0 Examples: 15 Common Pentest Findings Scored
Fifteen findings you raise in almost every test, each scored in CVSS 4.0 with a full vector and the reasoning behind it, set beside its 3.1 score so you can see exactly where the two versions part company.
Common Penetration Test Findings and How to Write Them Up
The 27 findings that recur in almost every infrastructure, Active Directory, web, cloud and API test, what to say about each, and how to write each one once so it is reused.
Vulnerability Remediation Timelines: A Defensible SLA Table
Remediation timelines by severity for penetration test findings, checked against Cyber Essentials, the NCSC’s timescales, PCI DSS v4.0.1 and DORA, with exceptions, risk acceptance and how a retest proves the clock.
Cloud Penetration Testing Rules: AWS, Azure and Google Cloud
Do you need permission to test AWS, Azure or Google Cloud? Each sets its own rules. The three side by side, as of October 2026: what needs no approval, what is prohibited, and what belongs in your RoE.
OWASP Top 10 2025 vs 2021: What Changes in Your Reports
The OWASP Top 10 2025 set against 2021 in one table, what moved and why, the two new categories, where SSRF now sits, and how to re-map a findings library and report templates without breaking older reports.
Penetration Testing Glossary: 60 Terms Defined
Plain, quotable definitions of the terms people meet in penetration test scopes, reports, retests and schemes, grouped so you can point a client at the one they asked about.
Free Reporting Tool
Our free, open-source reporting tool: installing it on your own server, a whole engagement in it, and moving to Pental when you want the Portal.
Self-Hosting a Free Pentest Reporting Tool
Install our free, open-source reporting tool with one command, share it with your team over Tailscale or your own domain, and keep it up to date and backed up.
From Finding to Word Report in the Free Reporting Tool
A whole engagement in our free reporting tool: fields and sections your way, findings drafted from your evidence with AI on your own key, and the report in your own Word template.
Moving From the Free Reporting Tool to Pental
What the Portal adds to our free reporting tool, what stays exactly as it is, and the three steps that bring your team, clients and findings across in one file.
AI Pentest Report Writing in the Free Reporting Tool
Our free reporting tool drafts findings, summaries and sections with AI on your own key or your own hardware: what each AI button does, how to set a provider up, and where every request goes.
Exporting Pentest Findings to Excel, Word or PDF
Export findings from our free reporting tool to Excel, PDF or Word, from one finding to every phase at once, and bring an edited sheet back in with every change shown first.
Editing a Pentest Report in Word and Bringing It Back
Download a report from our free reporting tool as your Word file, edit it or send it round, and upload it back. The tool shows each edit, tracked change and comment it reads before anything is written.
Branding Pentest Reports in the Free Reporting Tool
Your logo, colours and fonts in our free reporting tool, your sign-in page and company details, and every report in your brand, from the built-in PDF styled your way to your own Word template.
Your Database
Three places it can live, the pros and cons of each, and moving from one to another.
Creating Your Database: Three Ways to Run It
Your portal runs on a database you own, in one of three places: PostgreSQL in your own cloud, self-hosted Supabase, or Supabase Cloud. What each is, its pros and cons, and the full guide for each.
Setting Up Your Database on PostgreSQL in Your Cloud
Your cloud’s own PostgreSQL on Azure, AWS or Google Cloud, or a server of yours, with the small Pental gateway beside it. One command builds it all, and it applies Pental’s signed updates itself.
Setting Up Your Database on Self-Hosted Supabase
Supabase’s open-source stack on a server you run, from a kit we give you. One paste on the server puts in Docker if it is missing, makes the stack’s secrets and starts it, and it sets up and updates its own database.
Setting Up Your Database on Supabase Cloud
A Supabase project in your own account, set up in five steps the setup checks as you go: the project, its publishable key, the setup SQL, the access token hook, then connect.
Moving Your Database Between Homes
Take everything (people, clients, findings, files and secrets) from PostgreSQL in your cloud, a self-hosted stack or Supabase Cloud to either of the others, in your own browser, with nothing passing through Pental.
Running Your Portal
Everything after the database: your domain, your templates, your AI, your people and your clients.
Putting Your Portal on Your Own Domain
One DNS record, sometimes a second to prove the domain is yours, then the portal verifies it and issues a certificate. Most failures are the same four causes, and the setup screen tells you which one you have hit.
Switching Off the Parts of the Platform You Do Not Use
Settings, then Feature Modules. A module that is off disappears for everyone, its pages included, and everything in it is kept for the day you switch it back on.
Sending Portal Email from Your Own Domain
The connection is set on your pental.io dashboard, the wording in the portal. Connect your mailbox and your own side sends the portal’s email; until then it goes out through Pental.
Single Sign-On Under Your Own Name
Register a Google or Microsoft application of your own, paste the two values into your portal, and the consent screen your team and your clients see carries your name instead of ours. The redirect URI is the part people get wrong.
Keeping Reports and Files in SharePoint or Google Drive
Settings, SharePoint & Drive. Off until you switch it on: every report, attestation and file the portal keeps is copied into a folder for each client and engagement, named as you set it, and kept up to date.
Sending Client Credentials to Your Password Manager
Settings, Integrations, Password managers. Connect 1Password, Bitwarden, Passbolt or Keeper once and testers send a client’s credentials in one click from your own gateway; KeePass, HashiCorp Vault and the rest take them from the tester’s own browser.
Customising Finding Fields, Prompts and Dashboards
Rename, reorder and require the fields of a finding, add your own in ten styles, give each AI-written field its own prompt, and lay out the dashboard each role sees.
Making Your Word Template the One Pental Fills
Settings, PDF & DOCX, Open the Document Builder. Drop in a document you already send: with an AI connected the build starts at once, shows its stages, and ends on a card where you check it, preview the pages and save.
Fixing a Template That Renders Inconsistently
Nearly every rendering complaint traces to formatting applied to the paragraph instead of held on a style. Word hides the difference from you; anything reading the file can see nothing else.
The Findings Library: Write a Finding Once, Reuse It
Your firm’s own reusable findings, on from the start. Add a finding from the finding itself, in bulk or automatically once it is final, and bring the agreed wording into any engagement.
The Executive Summary and the Rest of the Report’s Sections
The executive summary drafted from every finding and your notes, the caveats and retest summary each written to its own prompt, sections of your own, and how to rename, reorder and control every section of the report.
Reporting in Another Consultancy’s Word Template
Doing overflow work for another consultancy? Keep their Word template beside your own, choose it for their engagements, and every other client keeps getting your report.
Connecting an AI Provider, or Running One Yourself
Settings, then AI: Ollama on your own hardware, Groq, OpenAI, Anthropic, or an OpenAI- or Anthropic-compatible endpoint. With your own key, your own side sends every request, so neither key nor text passes through Pental.
Running AI Drafting on Hardware You Own
Ollama on each tester’s machine, or one shared box over HTTPS. The setup is small, and the part that catches everyone is that the request comes from the browser rather than from a server.
Writing a Pentest Finding from Your Notes with AI
Paste your notes and screenshots into a finding, press one button, and every field is drafted from the evidence in your firm’s own style: the title, description, remediation, CVSS score and vector, CWE and affected hosts.
Adding Your Team, Roles and Multi-Factor Authentication
Five roles, and what your database holds each to. Two second-factor methods, a policy for whether one or both are required, and two inactivity windows worth setting deliberately.
Setting Up Multi-Factor Authentication for Your Firm
Two methods, one or both required, and the rule that a passkey needs a backup authenticator. Plus the inactivity windows, where active sessions are listed, and how a locked-out colleague gets back in.
What Your Clients Actually See in the Portal
The client portal shows a client their own engagements, the findings you release, the documents you deliver and the checklists you share, and nothing else. What is on each screen, and what controls it.
Importing Scanner Output as Findings
Bring a Nessus, Burp, OpenVAS, Qualys, Nmap or SARIF export into a phase of an engagement as findings: one for each issue with every host listed, in your library’s wording where it has the issue, and nothing written until you have seen it.
Checklists and Runbooks for Every Phase of a Pentest
A methodology library of 22 checklists and 21 runbooks, from OSSTMM and PTES to OWASP and MITRE ATT&CK, suggested on each kind of phase once added, ticked by your testers, shown to the client if you choose, and moved in and out as Excel, Word or JSON.
Reviewing a Report Before It Goes Out
How QA works end to end: submitting, the seven places in the queue, counts that filter and phases, commenting on the exact words, suggesting against applying, your own QA checklist and the AI reviewer, finishing, delivering and sending back.
Live Reporting: Showing a Client Findings as You Find Them
Save a finding as a draft in one click and get back to testing, show it to the client while the test is still running, and let the platform make sure nothing goes out in the final report until it is finished.
Delivering a Pentest Report and Its Letter of Attestation
Deliver the report to the client’s portal with an email or without, give them a letter of attestation they can pass on, and name every file the way your firm names them.
Retests, and Your Client’s Jira, ServiceNow or GitHub
Clients ask for a retest of a finding in one click, or by closing its ticket in their own tracker. Your team retests it from one list and records the outcome on the finding.
Scheduling Testers and Automating Engagements
See who is testing what each week, give an engagement nobody holds to a tester with a free week, and let engagements start and complete on their dates, with clients reminded to send credentials in time.
Client Feedback and Google Reviews After Every Engagement
Ask every client how the engagement landed with a short rating in their portal, or send them to your Google reviews instead, after their first engagement or after every one.
External Testers and Teams for Overflow Pentest Work
Switch external testers on, make a team for each consultancy that takes your overflow work, and hand it an engagement: everyone in the team works on it, and nobody outside it sees it.
A Pentest Engagement in Pental, From Booking to Retest
One engagement through Pental from start to finish: booking a tester, testing to a checklist, writing findings from your notes, showing the client as you go, QA, delivery, retests and feedback, with a guide for each step.
Something Here You Would Like Covered Properly?
Tell us what keeps coming up on your engagements and we will write it up.