Delivering a Pentest Report and Its Letter of Attestation

Delivery should be the easiest part of an engagement and is often the riskiest: the wrong version attached, a report sent to an old contact, a PDF that lives on in somebody’s inbox forever. In Pental the report is delivered to the client’s portal, where they download it under your brand, and the email only tells them it is there.

Delivering

With QA in use, a reviewer signs the report off and, if they may deliver it, Approve and deliver does both at once. Otherwise, once a report may go, Deliver Report on the engagement sends it. Either way, while the delivery email is switched on, the platform asks one question first: Deliver and email, which tells the client’s contacts the report is waiting in their portal, or Deliver, don’t email, for a client you are telling some other way.

If anything in the report is still marked as a draft, the approval and the delivery both stop and list it first. Live reporting explains why, and how to finish them from the list.

A delivered report can be taken back. Send back to QA removes it from the client’s portal straight away, without emailing anybody, and returns it to review with everything kept. Reviewing a report before it goes out covers it.

The letter of attestation

Plenty of people need proof that a test happened and nothing in the full report: an auditor, an insurer, a prospective customer’s security team. The letter of attestation is that proof, on one page, under your brand. It says who tested what, for whom and when, to which methodology, and where the serious findings stand (none found, or all of them fixed), and it says plainly that it is not a substitute for the full report.

Once the report is delivered, its letter sits beside it on the engagement, one click to download, with an editor for its wording when an engagement needs something particular said. Under Settings, Attestation you choose whether it carries your director’s signature, and its Visibility: Enabled puts it in the client’s portal next to their report, Internal Only, to begin with, keeps it to your team, and Disabled removes it.

For what an auditor looks for in one, see writing an attestation letter an auditor will actually accept.

Files named the way you name them

Settings, File Naming sets the name of every document the portal makes, from tokens: {job_code}, {client}, {client_short}, {assessment}, {date}, {year}, {type} and the rest. The report as a PDF and as a Word file, the letter of attestation and the findings export each have their own pattern. Empty tokens are skipped and the extension is added for you.

Your testing IP addresses on every report

Settings, Testing IPs lists the addresses your team tests from. The report prints them, and the engagement shows them under its scope, so the client’s team can recognise your traffic, let it through, and tell it apart from anyone else’s.

For why the portal beats email for this, see delivering pentest reports without emailing PDFs.