A Pentest Engagement in Pental, From Booking to Retest

A penetration test runs the same course every time: it is booked, tested, written up, reviewed, delivered and, once the client has fixed things, retested. In Pental every step happens on the engagement itself, with the client following it in their own portal, and each step has a guide of its own. This one follows a single engagement from booking to retest, so you can see how the steps fit together before reading about any one of them.

Book it and give it a tester

An engagement is created for a client, usually with a phase for each kind of testing sold, such as a web application test and an external infrastructure test. Each phase says whether the client can ask for a retest, so the button for one only appears where a retest was sold.

Calendar, in the sidebar, lays out each tester’s engagements by day for the week. Engagements nobody holds yet wait underneath for a lead: choose a tester with a free week from the list beside one and confirm, and they are told by email if you want them to be. The engagement is then theirs, on their calendar and their dashboard.

Full size

Calderwood SecurityTheir team, finding who is freeDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Under Settings, Automation, a booked engagement can start on its start date once it has a lead, and complete on its end date, in your own time zone and working week. Before an authenticated test, the client’s contact can be reminded to send their credentials on the days you choose, until they do. Scheduling testers and automating engagements covers both.

Before testing starts

The client sees the engagement in their portal from the moment it is booked, with its dates, its status and its lead tester. When it needs credentials or authorisation details, their dashboard says so, with how soon testing begins and a Submit credentials button, and what they send goes to your database for your testers to collect.

Test to a checklist

Each phase can carry a checklist or a runbook from Settings, Checklists & Runbooks, where the methodology library holds 22 checklists on published standards, from OSSTMM, PTES and NIST SP 800-115 to the OWASP lists, MITRE ATT&CK and PCI DSS, and 21 runbooks. A web application, infrastructure, cloud, mobile or wireless phase is offered the library’s checklist and runbook for its type, testers tick each item as they cover it, and one marked Visible to clients shows the client its progress without letting them change it. Checklists and runbooks explains the library.

Write findings from your notes

Testers paste what they captured into a finding’s evidence, notes, requests, output and screenshots as they were taken, and Generate all from evidence drafts the rest from it to your firm’s own prompts: the title, description, remediation, CVSS score and vector, CWE, category, affected assets, references and your own fields. It runs on your own AI key or on a model on your own hardware, and where your Library already holds a finding with that title, your agreed wording fills what it can rather than being written again.

Full size

Calderwood SecurityTheir team, writing a findingDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Save as draft and close records a finding as it stands and gets the tester back to testing. New findings are drafts unless your firm chooses otherwise. Writing a pentest finding from your notes with AI goes through each field.

Show the client as you go

A finding reaches the client only when its Client Visible switch is on. Switch one on mid-test and the client sees it in their portal straight away, marked as a draft until the write-up is final, and for a high or critical finding the switch asks whether to email them as well. They can talk it over with your team in the engagement’s comments rather than by email. Live reporting covers when to use it.

Full size

Calderwood SecurityTheir client, reading a findingDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Write the summary and sections

On the engagement, Generate with AI drafts the executive summary from every finding and your notes, and the caveats, the retest summary and any section of your own are written beside it, each to a prompt of its own. Every section has its own Draft and Client Visible switches. The executive summary and the report’s sections explains each.

Review it

Once testing is finished, Submit for QA checks the report for anything your firm requires and puts it in the QA queue. A reviewer comments on the exact words, suggests changes for the author to accept or reject, or applies them, and ticks your own QA checklist if you keep one; an AI reviewer can read the report against that checklist too. Where the report is made from your own Word template, a reviewer who would rather work in Word downloads it with the review in it, as tracked changes and comments, and uploads the edited document back.

Full size

Calderwood SecurityTheir team, reviewing a reportDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

With nothing left open, the reviewer approves it. Nothing still marked as a draft, a finding or a section, can be approved or delivered: both stop at a list of what is unfinished, each with a way to finish it. Reviewing a report before it goes out covers the whole review.

Deliver it

Approve and deliver, or Deliver Report on the engagement, sends the report to the client’s portal, and while the delivery email is on, it asks first: Deliver and email, or Deliver, don’t email. Beside it sits the letter of attestation: one page an auditor or an insurer can be given instead of the full report, in the client’s portal too once its visibility is set to Enabled. A delivered report can be taken back with Send back to QA, which removes it from the client’s portal at once. Delivering a pentest report and its letter of attestation has the detail.

Retest what was fixed

Once something is fixed, the client presses Request Retest on the finding, or closes its ticket in their own Jira, ServiceNow, Azure DevOps, GitHub, GitLab or Linear. Requests gather under Retest Requests, where Begin Retest opens the finding for what was found this time, and Remediated, Part Remediated, Not Remediated or Risk Accepted records the outcome, which the client sees on the finding straight away.

Full size

Calderwood SecurityTheir team, retesting a fixDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

The retest summary for the engagement can then be drafted from those outcomes. Retests, and your client’s Jira, ServiceNow or GitHub covers both ways a retest is asked for.

Hear how it went

With the report delivered, the client’s dashboard asks for their view of it with Leave Feedback, or sends them to your Google reviews instead, and what they send through the form is listed on your Feedback page. Client feedback and Google reviews sets out the choices.

For everything the client sees along the way, read what your clients actually see in the portal. Starting smaller? Our free reporting tool covers the writing and the report on your own server, and moving from the free reporting tool to Pental brings it all across when you want the rest.