Editing a Pentest Report in Word and Bringing It Back

In our free reporting tool, a report made from your own Word template can go out to Word and come back. Download it, edit it in Word or send it round for review with Track Changes and comments, and upload it beside the report’s button. The tool reads the document back and lists what it finds changed before anything is written: plain edits and tracked changes to accept one by one, findings added or taken out, and Word comments to bring into the engagement. The file you upload can then be the report your team downloads.

What it needs

The round trip works on reports made from your own Word template, because the tool puts invisible bookmarks around each finding’s fields and around the executive summary, the retest summary, the notes, the caveats and your own sections as it fills one in. Those are the parts it reads back. Upload a .docx under Settings, PDF & DOCX, start from the Draft, or let the Document Builder turn a report you already send into one: branding pentest reports in the free reporting tool goes through all three. The built-in PDF has no round trip. Anyone on the team can upload an edited report, and an administrator or senior tester can go back to a generated one.

Download it and edit it

On the engagement, the report’s button downloads the Word file. With Produce the PDF automatically ticked for the report, that button makes the PDF instead, and Download the Word file sits beside the upload. With more than one template, the arrow beside the button picks another. Edit that copy in Word, keep Track Changes on if you like, and send it round: reviewers’ comments and their replies come back too.

Edit the words where they are. A block deleted and typed again loses its invisible bookmark, and what has no bookmark is not read back.

Upload it back

Beside the report’s button, Edited in Word? asks for the file: Click to upload DOCX, or drop the .docx on it. The document is read in your browser and compared with the engagement as it is now, and the review opens.

The review

The review is headed with the file’s name and lists what the document changes, in groups. First the engagement’s sections, such as the executive summary, notes, caveats, retest summary and your own sections. Then each finding, with the fields that changed, from the title, severity, CVSS and CWE to the description, remediation, evidence, references and your own fields. Then findings the document has and the engagement does not, which are added, and phases it names that the engagement lacks, which you can add. See what it will say opens the new wording, screenshots included.

Untick all unticks every change at once, so you can tick only the ones you want.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Word comments

Comments in the document are listed under the changes. They are not part of the report: ticked ones join the engagement’s Comments, each saying who wrote it in Word and where, on a finding’s field or on the report, and a reply in Word arrives as a reply. Upload the same file again and the comments already brought in are not added twice. In the Portal, a Word comment comes back into the QA thread of the field it was written on instead.

After you apply

Update the assessment writes what you ticked. Anything changed in the tool since the document was read is left out and named, so nobody’s later work is overwritten, and uploading the document again compares it with what is there now.

Make this the downloadable report, ticked to begin with, keeps the file you uploaded as the engagement’s report. Downloading then hands back your document rather than a generated one, with anything changed in the tool afterwards written into it on the way out. Untick it for a working draft you only want the edits from. The report’s row then shows Current report with the file’s name and when it came in, and Use a generated one goes back to generating the report from the engagement as it is now. With Produce the PDF automatically ticked, the PDF is made from your edited file, in your browser.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

When nothing comes back

A file the tool did not make, or one saved in a way that dropped its bookmarks, has nothing to read, and the tool says so: download the report again, make the edits in that copy and upload it. A document that already matches the engagement is reported as matching, and it can still be made the report your team downloads.

Exporting pentest findings does the same for a sheet of findings, and AI pentest report writing drafts what goes into the report before it ever reaches Word.