Exporting Pentest Findings to Excel, Word or PDF

Our free reporting tool exports pentest findings to Excel, PDF or Word: one finding, the ones you tick, a phase, an engagement or every phase at once. Excel takes the columns you choose, with a summary tab and a figures tab if you want them. PDF lays the findings out as your report does, and Word fills them into a findings template of your own. A sheet you changed in Excel comes back in, and the tool shows what would be added, changed and deleted before anything is.

Where to export from

Findings, in the sidebar, lists the findings of every engagement you have not archived in one place, to filter by severity or status, sort and tick.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

The export dialog

Export opens Export Findings. It names what it covers, all of an engagement’s findings, one phase, or every phase with a tab each, and offers Excel, PDF and, once you have a Findings export template, Word. It remembers your format and columns in that browser for next time.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Excel, with your own columns

The columns are your finding fields under the names you gave them: the finding ID, title, category, severity, CVSS, status and CWE, then the affected assets, description, evidence, remediation and references, and your own fields after them. A field you have switched off is not offered, and an export of every phase offers a Phase column too. All, None and Defaults set the ticks quickly. Include summary tab adds the severity counts per phase, the total and the assessment’s name, and Include figures tab adds an index of every figure with a link back to its finding. Rich fields keep their formatting in the cells.

PDF, laid out like your report

Without a template of its own, a findings PDF is laid out as your report prints its findings, in your report’s PDF styles: a summary table where there are several, then each finding on its own page. With a Findings export template, the PDF is that template filled in and made into a PDF in your browser.

Word, from your own template

Word export needs a Findings export template. Under Settings, PDF & DOCX, the Findings export row has a Draft to start from and a Placeholder Key that lists every placeholder you can place, your own fields included. Upload the finished .docx there. From then on the dialog offers Word, a finding’s page has a Word button, and each export fills the findings into your template wherever it places them. Branding pentest reports covers the report’s own template the same way.

File names

Each export downloads under a name you can set in Settings, File Naming, with a pattern for a findings export to Excel, one for every phase in Excel, and one each for a single finding or several as PDF or Word. Tokens such as {client}, {assessment}, {phase}, {finding} and {date} fill them in, and a pattern left blank keeps the built-in default.

Bring an edited sheet back

Export to Excel, change the findings there, and Import beside Export brings the sheet back. In Import Findings, Choose a file takes the .xlsx, or a .csv. Rows are matched to their findings by ID, or by title where a row has none. A row with no ID and a title the engagement does not have becomes a new finding, a row whose ID is not on the engagement is skipped with the reason, and nothing is written until you have seen what would happen.

Deleting is a choice of its own. Delete findings that are not in the file is off to begin with, and when it is on, the findings it would delete are listed by name. Apply asks once more, with the counts, before it changes anything, and the pictures, tables and code blocks on a finding stay as they are.

In the Portal, you can also let clients export the findings you have released to them, to Excel or as a PDF. For the report itself, editing a pentest report in Word takes the whole document out and back, and from finding to Word report follows an engagement from start to finish.