Reporting

Creating Reports from Your Existing Word Templates

Take the Word report you already send into Pental, step by step: what it reads from your file, every option on its card, the finding fields and sections it sets, and an engagement made on it. Then a partner’s report the same way, with fields and sections of its own.

By Arian Mosallah, OSCP, CRT

12 min read · Updated 8 November 2026

You already have a report your clients know: a Word file with your cover, your headings and your tables. This guide takes that file into Pental and through everything that follows from it: what Pental reads from it, every option on its card, the finding fields and assessment sections it sets, and an engagement created on it. Then it does the same for a partner consultancy whose report has fields and sections of its own, and shows what an engagement on that report has that one on yours does not. The pictures are Calderwood Security’s portal, with Thornbury Cyber as its partner.

Where your reports are

Reports are set up by an administrator, in Settings, Documents, on the report’s row. Before any Word file is there, the row holds one card, your Default, made with Pental’s own PDF, and under it the area your Word file goes into.

Settings, Documents, the report’s row before any Word file: the Default made with Pental’s own PDF, its Document Builder and draft buttons, and Upload your report with Choose a .docx and Or one without a Word file. — **Upload your report**: choose the .docx of the report you send, or drop it here.
Your **Default**, which engagements are created on. Until it has a Word file it is made with Pental’s own PDF, and **Edit** already opens its finding fields and sections.
**Build its Word file with the Document Builder**, or **Download a draft with its placeholders**.
**Placeholders** lists every placeholder a Word template for the report can hold.
The report’s row in Settings, Documents, before any Word file is uploaded.Calderwood SecurityTheir team, before uploading their reportDemonstration portals. The four firms are invented; every screen is the real software.

Get your Word file ready

Pental fills a Word file through its placeholders, such as {client_name} or {executive_summary}, and the finding fields and sections an engagement shows are read from the ones your file holds. So what you upload depends on where your report is now:

If it already holds Pental’s placeholders, upload it as it is.
If it is a template made for another reporting product, upload it all the same. A template from one of the products Pental converts is recognised as it goes up, and before anything is saved you see each of its placeholders turned into Pental’s, then Save as a report template. Bringing a template from another product across covers what it converts.
If it is a finished report you sent, with no placeholders in it, build its Word file first, with Build its Word file with the Document Builder on its card. A file with no placeholders goes up, but the report it makes is the file as it is, and your fields and sections stay as they were. Making your Word template the one Pental fills walks through the builder.
If you have nothing yet, Download a draft with its placeholders gives you a Word file with the report’s fields and sections as placeholders, under its own names, to lay out in Word. Placeholders lists everything else a report can print, with Download a draft with them all.

The file must be a .docx of 5 MB or less.

Upload your report

Open Settings, Documents, and on the report’s row press Choose a .docx, or drop the file on Upload your report.
It goes up as your Default, under the file’s name. It is what the DOCX download button makes on your engagements, and your finding fields and assessment sections are set to the ones it prints, there and then.
A message names what changed, for example that the Appendices are now off, and pressing the message puts everything back as it was.

Nothing is asked: the file decides. If your fields and sections already match it, the message says it prints the ones you have on.

What Pental reads from your file

Each finding field and each section is read by any of the placeholders it can be printed with, so References printed as a list count as much as References in a sentence. A field’s has_ placeholder, the one that shows part of a page only when the field is filled in, counts too: {#has_cwe} reads CWE as surely as {cwe} does.

Finding field	Printed by any of
Category	`{category}`
CVSS	`{cvss}`, `{cvss_score}` or `{cvss_vector}`
CWE	`{cwe}`
MITRE ATT&CK	`{attack}`
Description	`{description}`
Remediation	`{remediation}`
Evidence	`{evidence}` or `{evidence_content}`
Affected Assets	`{affected_hosts}` or `{hosts_list}`
References	`{references}`, `{refs_list}` or `{references_list}`
A field of your own	`{custom_` followed by its id: the message names it as the field is added, and the report’s draft with its placeholders holds it

Section	Printed by
Executive Summary	`{executive_summary}`
Scope	`{scope}`, the `{#scope_items}` loop or `{scope_phases}`
Caveats	`{caveats}`
Artifacts	`{artifacts_text}`
Severity Summary	Any of the counts, such as `{critical_count}` or `{total_findings}`, or the chart, `{radar_chart_image}`
Retest Summary, Notes and sections of your own	Their placeholders, or put in after the executive summary where a file has no place for them, so a file never switches them off
Findings	Any of its loops, so a file never switches it off
Appendices	Pental’s own PDF alone: no Word file has a placeholder for them, so a file that prints any section switches them off
Documents, Timeline, Credentials, Files, Comments	Nothing: they are working areas no report prints, and a file never switches them

A file that prints no finding field by name leaves your fields as they are, and one that prints no section by name leaves your sections, so a layout of its own is never read as one that wants everything off. Title, Severity and Status are every finding’s own and stay on whatever a file prints. And a field or section switched off is not deleted: whatever was written in it stays on its findings and engagements, out of sight and out of the report, and is back when it is switched on again.

Every option on its card

Once your file is up, its card carries everything about the report, and the row above it the switches that are about every report.

The firm’s own report, the Default, once its Word file is uploaded: Edit and its file’s buttons, what it does, two versions with a star to make either its main file, Add a version, and Make the PDF automatically above it. — **Placeholders** lists every placeholder, and **Styles** the Word styles used for code, headings, captions and lists.
**Make the PDF automatically**: each time a report is made, or an edited copy uploaded, its PDF is made in your browser and kept as its final PDF, unless you upload one yourself.
What it does: engagements are created on it, it sets the assessment area and finding form (here 10 fields and 8 sections), and it is on the **DOCX download button**.
**Edit** opens its lists, below.
Its Word file: a new copy of it uploaded in its place, downloaded, the report renamed, or the file deleted.
The star makes a version its main Word file, and the main one a version.
**Add a version**: another Word file of it, such as a retest or a summary, in the dropdown beside the **DOCX download button**.
**Build its Word file with the Document Builder**, or **Download a draft with its placeholders**.
Your Default once its Word file is up, with two versions.Calderwood SecurityTheir team, with their report uploadedDemonstration portals. The four firms are invented; every screen is the real software.

A new copy of the main Word file keeps its name and its place, and sets the report’s fields and sections again from what it prints, with the same message and the same way back. A version replaced is only replaced.
A version made the main file with its star is what the button makes from then on, and the report’s fields and sections follow it.
Renaming the Default renames its Word file. A report of your own takes the name you give it, its Word file renamed to match. Two reports cannot share a name.
Deleting the Default’s Word file says first which file takes its place: its first version, or Pental’s own PDF where it has none.
With Make the PDF automatically ticked, each Word file says whose download menu its PDF appears in: Convert for us, and Convert for the client as well. A report’s main file is always converted for you, since its PDF is what its button then downloads.

Its finding fields

Edit opens the report’s lists under three tabs, Finding fields, Sections and Severity, the same on every report. Nothing changes until you press Save the Default (Save template on a report of your own), and Discard changes drops what you did.

A report’s Finding fields tab: each field with its name in this report and its On, Required and In report boxes, MITRE ATT&CK marked Not in its Word file, and the AI prompt under Description opened. — The three tabs every report has.
How many of its fields are required. A finding missing any of them is shown as a draft, and **Save as final and close** asks for it before letting the finding through.
Each field’s **Name in this report**, and whether it is On, **Required** and printed **In report**. The arrows set the order.
**Not in its Word file**: the file has no placeholder for it, so it is not printed, nor shown to clients.
The **AI prompt** a field is written with, opened under Description.
Your Default’s finding fields, with MITRE ATT&CK not in its Word file.Calderwood SecurityTheir team, editing their reportDemonstration portals. The four firms are invented; every screen is the real software.

A name left empty is the field’s own, so one report can call Remediation a Recommendation and your others keep their word for it. In report off keeps a field on the finding for your team, out of the report and out of the client’s view. Tick On for a field the Word file does not print and it is on for the report’s engagements and out of the report, and the message says so.

Where a report’s lists and its file disagree, for a report set up before its file or changed since, a line over the list says what would match the file, with Match it.

Add field, under the list, makes a field of the report’s own, such as Business Impact: name it, choose its kind (Rich text, Long text, Text, Choice, Number, Date or Link), give a Choice its choices, and give it an AI prompt if you like. It is on for that report alone, and out of its report until the report’s Word file has its placeholder, which the message names. Put the placeholder in the file, upload the file again in its place, and the field is printed.

What a field is, its kind and its choices, is shared by every report and changed under Settings, Finding Fields. Its AI prompt is shared too, until you change it in a report’s list: the change is that report’s own, and its engagements are written with it. Tick Change it for every report that has it and it is every report’s instead; Use the shared prompt puts a report back on the shared one, and Reset to default gives back Pental’s own prompt for it. With only your Default, a change in its list is the shared prompt.

Its sections and severity

Sections lists the engagement’s sections the same way, each with its Name in this report, On and In report, and its order. The working areas say Never printed, and a section the Word file has no placeholder for says Not in its Word file. Add section makes one of the report’s own, such as an attack narrative, printed where its file places it, or after the executive summary.

Severity sets what the report calls each of the five levels, which levels it offers on a finding (Offered), their colours in its reports, and CVSS 3.1 or 4.0. A name left empty is the usual one, and a colour Your usual. Counts, charts and filters work on the same five levels whatever a report calls them. Your Default’s CVSS is your firm’s, the same as under Settings, Findings.

A partner’s report, the same way

Thornbury Cyber passes Calderwood its overflow work, and Thornbury’s clients expect Thornbury’s report: its Word file, its fields and its names for things. It gets a report of its own, made the same way.

On the same row, press Choose a .docx under Upload another report, or drop their file there.
It is a report of its own at once, named after the file (with a number where that name is taken), with the finding fields and sections their file prints. Nothing is asked, and nothing of your Default changes.
The message says it was added and to pick it when you create an engagement.
Rename it with the pencil on its card if their file is called something else, and put a second layout of theirs, such as a client copy, under it with Add a version.

Settings, Documents, the report’s row: the firm’s own report, the Default, with two versions in the dropdown beside the DOCX download button, a partner consultancy’s report of its own with a client copy, and the area to upload another report. — Thornbury’s report, a card of its own: **Offered when an engagement is created**, its own count of fields and sections, and its **API id**.
**Upload another report** is where their file went in.
Calderwood’s Default and Thornbury’s report, each with its versions.Calderwood SecurityTheir team, setting up their reportsDemonstration portals. The four firms are invented; every screen is the real software.

A report of your own has two choices the Default does not. Its letter of attestation picks the Word file its letters of attestation are made with, As the Default until you choose. And a report with no Word file yet, made with Or one without a Word file, says how it is made until it has one: like the Default, or with Pental’s own PDF. Upload its Word file on its card gives it one later.

Their file is their report’s alone: your Default is never made with it, and engagements on other reports are not offered it or its versions.

Where its lists differ

Press Edit on Thornbury’s card and its lists are its own. Their file prints MITRE ATT&CK and no category, CWE, caveats or artifacts, so those were switched as it went up. Business Impact was added after, with Add field, and its placeholder put in their file. The names are Calderwood’s, given to match Thornbury’s headings.

A partner consultancy’s report’s finding fields: Category and CWE off and not in its Word file, MITRE ATT&CK on, Remediation named Recommendation, a Business Impact field of its own, required, and Add field and Save template. — CWE is off, like Category: Thornbury’s file has no place for either.
MITRE ATT&CK, which their file prints, is on here, and off on Calderwood’s Default.
Remediation is called Recommendation in this report alone.
Business Impact, a field of its own made with **Add field**: on, **Required** and printed.
**Add field**, for another of its own.
**Save template** keeps what you changed.
Thornbury’s finding fields.Calderwood SecurityTheir team, editing a partner’s reportDemonstration portals. The four firms are invented; every screen is the real software.

The partner’s report’s sections: Notes kept out of the report, Credentials never printed, Artifacts, Caveats and Appendices not in its Word file, and the Executive Summary named Management Summary. — Notes is on and out of the report: kept for the team.
Credentials, a working area, is **Never printed**.
Caveats is off, as are Artifacts and the Appendices: none is in its Word file.
The executive summary is the Management Summary in this report.
Thornbury’s sections.Calderwood SecurityTheir team, editing a partner’s reportDemonstration portals. The four firms are invented; every screen is the real software.

The partner’s report’s severity levels: Medium named Moderate and Info named Informational, every level offered in the firm’s usual colours, and CVSS as the Default. — Medium is Moderate, and Info Informational, as Thornbury calls them.
Untick **Offered** for a level they do not use. A report offers at least one.
Its colours in its reports: **Your usual** until changed.
CVSS 3.1 or 4.0, or as the Default.
Thornbury’s severity levels.Calderwood SecurityTheir team, editing a partner’s reportDemonstration portals. The four firms are invented; every screen is the real software.

Creating an engagement on it

Once there is a second report, New Assessment has a Report choice, your Default first, by its name. It decides the Word file the engagement’s report is made with and the finding fields and assessment sections the engagement shows, and it can be changed on the engagement later. The sections offered for filling in as you create the engagement follow the report you pick, and a copy of an engagement keeps its report.

New Assessment with a partner consultancy’s report picked under Report, which sets the Word file the report is made with and the finding fields and sections the engagement shows. — Thornbury’s report, picked for this engagement.
New Assessment, with the partner’s report picked.Calderwood SecurityTheir team, creating an engagementDemonstration portals. The four firms are invented; every screen is the real software.

If you make engagements from your own tools, the Pental API takes a report’s API id, from its card, as p_report_template.

How the engagement matches its report

An engagement is drawn in its report: its page shows the report’s sections under the report’s names, and its findings the report’s fields. Here is an internal infrastructure test on Thornbury’s report.

An engagement on the partner’s report: its name beside the lead, no Artifacts or Caveats, the counts reading Moderate and Informational, a Management Summary, and findings with no category or CWE column, drafts until their Business Impact is written. — The report it uses, beside its lead. Pressing it changes the report, after a preview of what would change.
The counts, under Thornbury’s names for the levels.
Its executive summary, as Thornbury calls it. Artifacts and Caveats, off in its report, are not on the page.
Its findings, with no category or CWE column, drafts while the Business Impact Thornbury’s report requires is empty.
An engagement on Thornbury’s report.Calderwood SecurityTheir team, on an engagement on a partner’s reportDemonstration portals. The four firms are invented; every screen is the real software.

A new finding on the partner’s report: severity Moderate, and CVSS beside MITRE ATT&CK where the firm’s own report has category and CWE. — Its levels under its names: Moderate.
MITRE ATT&CK beside CVSS, where your Default has Category and CWE.
A new finding on Thornbury’s report.Calderwood SecurityTheir team, writing a finding on a partner’s reportDemonstration portals. The four firms are invented; every screen is the real software.

Further down the same form are Description, Recommendation, Affected Hosts and References, and last Business Impact, required, so Save as final and close asks for it. Against an engagement on Calderwood’s Default, one on Thornbury’s report differs like this:

On the engagement	On Thornbury’s report
Sections	No Artifacts, Caveats or Appendices, and a Management Summary where the Default has its Executive Summary.
The finding form	MITRE ATT&CK and Business Impact, and no Category or CWE. Remediation is Recommendation, and Affected Assets Affected Hosts.
Required	Business Impact as well, so a finding without it is a draft.
Severity	Moderate and Informational on its findings and its counts, where the Default has Medium and Info.
The report	Thornbury’s Word file on the DOCX download button, and its client copy in the dropdown beside it.

A field the report does not have is printed nowhere, in Pental’s own PDF or in a Word file, even where a finding still holds a value for it.

Changing a report later

Change a report’s lists and every engagement on it follows. Nothing written is lost: a field switched off keeps its words, and shows them again when it is switched back on.
Upload a new copy of a report’s Word file in its place and its fields and sections follow the new copy, with the message and its way back.
Move one engagement to another report from its header. What would change is shown first, and anything written in a field the new report does not show is kept aside or added to one it does. Report templates for each engagement covers the preview.
Deleting a report says first how many engagements use it, and they go back to your Default. Its Word file and its versions go with it.

Who sees what

Settings is an administrator’s, so reports are set up by an administrator; anyone on your team who can edit an engagement can move it to another report from its header. A client sees an engagement’s fields, sections and severity names as its report sets them, and never which report it is. An external tester sees which report their engagement uses and cannot change it, and an engagement they create starts on your Default: your database enforces both.

The same walk through is in the product demo, in its chapter on your report templates: a partner’s Word file uploaded, its lists opened, and an engagement created on it. Taking overflow work from another consultancy is reporting in another consultancy’s Word template in short, and handing yours to one is external testers and teams for overflow pentest work.

Upload Your Report on the Trial

Open Settings, Documents on the trial and upload the Word report you send today. Then upload a partner’s, pick it on a new engagement, and compare the two.

Only need the reporting? Our reporting tool is free and open source, on your own server.

Start free trial All guides

Also Worth Reading

Reporting

Making Your Word Template the One Pental Fills

Settings, Documents, Open the Document Builder. Drop in a document you already send: with an AI connected the build starts at once, shows its stages, and ends on a card where you check it, preview the pages and save.

Reporting

Fixing a Template That Renders Inconsistently

Nearly every rendering complaint traces to formatting applied to the paragraph instead of held on a style. Word hides the difference from you; anything reading the file can see nothing else.

Reporting

The Findings Library: Write a Finding Once, Reuse It

Your firm’s own reusable findings, on from the start. Add a finding from the finding itself, in bulk or automatically once it is final, bring across a library you already have, and use the agreed wording in any engagement.

Setup guide

Prefer to watch it?

The whole setup recorded, with chapters you can jump to: registering, your own domain, your own database in any of three places, your own mail server, branding, the first sign-in, updating the database on Supabase Cloud, and moving the database if you change your mind.

0:00 · Registering, signing in, and the free trial
0:44 · Your name and your firm’s name
0:50 · Custom domain
+6 more

Open the setup guide · 10:01 Start free trial