From Finding to Word Report in the Free Reporting Tool

This takes one engagement through our free reporting tool, from setting it up the way your firm writes to the Word report the client receives. If it is not installed yet, self-hosting a free pentest reporting tool does that with one command.

Set it up the way your firm writes

Under Settings, Findings, rename any built-in field, hide the ones you do not use, decide which are required and which carry across from the library, and put them in your order. Add fields of your own in ten styles: rich text, plain text, a single line, a short value, a number, a date, a dropdown with colours, multiple choice, yes or no, and a link. Settings, Assessments does the same for an engagement’s sections: rename, reorder, give an icon to, switch off or leave out of the report any built-in section, and add your own.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Your logo for each theme, your colours and your fonts go under Settings, Branding, and your public testing addresses under Settings, Assessments, which carries them onto your reports.

Make the engagement

An engagement has a reference code, numbered your way or random, a type from your own list, its dates, test days, perspective and lead tester. Split it into phases, external, internal, web, retest or whatever shape the work takes, each with its own type, scope, test days and retest setting. There is no status to move along: the engagement is open from the moment it is made, and its report downloads whenever you like.

Every client has a page under Clients, with their contact and their engagements, and New Assessment there starts one for them. Calendar shows each tester’s engagements week by week, and lists the ones still waiting for a lead, to give one from there.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Each phase can carry checklists and runbooks. A methodology library of 22 checklists and 21 runbooks comes with the tool. The checklists follow OSSTMM 3, PTES and NIST SP 800-115, OWASP, MITRE ATT&CK, PCI DSS and more, each item saying what to check and what to record, and the runbooks take an engagement from kick-off to close-out and run each kind of test, red team, phishing and physical work included. A phase of a default type is offered its checklist and its runbook: web application (OWASP WSTG), internal infrastructure, external infrastructure, cloud, mobile (OWASP MASVS) and wireless. Tick items as you test, follow a runbook’s steps with each command a click to copy, and write your own under Settings, Checklists & Runbooks, where they also come in and go out as Excel, Word or JSON.

Write findings from your evidence

Paste what you captured into a finding’s evidence as rough as it was taken: notes, tool output, requests, tables and screenshots. Generate all from evidence turns it into a finished finding. It explains each piece of evidence and captions every screenshot, rewrites your notes as report prose with every value kept and the to-dos left out, names the finding and brings in your library’s wording where you have written the weakness up before. Then it drafts the description, remediation, CVSS vector, CWE, category, affected assets, your own fields and the references, each step using what the ones before it wrote. What is already written stays as it is, and one undo puts everything back.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

Every field has its own button too, so one part can be redone and the rest kept, and any field can be rewritten to an instruction of yours or to Shorter, More detail or Plain English. The prompt behind each field is yours to rewrite under Settings, Findings, and Reset to default puts the built-in one back.

The AI runs on your own key with Anthropic, OpenAI or Groq, on any compatible endpoint you host or trust, or on Ollama on your own hardware. Set it under Settings, AI, where Test Connection tries it before you rely on it. Your key is kept encrypted in your own database.

Score in CVSS 3.1 or 4.0 from the metrics, so the score and the vector always agree, with the severity set by the score or by hand. A finding is a draft until its required fields are filled. CVSS 4.0 examples scores fifteen common findings.

Keep a library

Save a finding to the library once and reuse it with exactly the fields you choose. Typing a title searches it, Import from Library brings entries into an engagement, and the library can take every new finding by itself and keep its wording up to date from findings you rewrite.

Retests and summaries

Mark findings for retest and record each result as remediated, part remediated, not remediated or risk accepted. The executive summary and the retest summary are drafted from the findings in the assessment, in the structure you set, and sections of your own are drafted from prompts of their own. All of it goes into the report.

The report, in your own Word template

Every engagement becomes a report two ways, both in your brand. The built-in PDF is styled from your settings: your cover, a contents page, a version history, a severity summary and chart, every finding, your appendices and your footer. Or upload your own .docx under Settings, PDF & DOCX, and every report is your template filled in as a Word document, with the PDF made from it in your browser if you like.

• Start from the Draft, a ready-made template in your colours with every placeholder in it, your own fields included.
• Or let the Document Builder turn a report you already send into a template: the AI places each placeholder where it belongs, for you to check and save.
• The Placeholder Key lists everything you can place.

Full size

Corvane SecurityIn our free reporting toolA demonstration: Corvane Security and its client are invented. Every screen is the real software.Drag sideways to see the whole screen.

With no report of your own yet, our free Word report template and how to write a penetration test report are a place to start.

Edit it in Word, then bring it back

Download the report as your Word file, edit it in Word or send it round for review, and upload it back beside the report’s button. The tool shows what changed before anything is written: plain edits and tracked changes, each one yours to accept, and Word comments, which join the engagement’s comments saying who wrote them and where. The file you upload can then be the report your team downloads, kept up to date with anything changed since.

Exports

Findings go out to Excel, PDF or Word: one finding, an engagement, or every phase at once, with the columns you choose. A sheet you changed in Excel comes back in, and the tool shows what would change and what would be deleted before anything is. An administrator can download every report at once under Settings, Data, as a ZIP of PDFs: with a Word template, an engagement whose PDF has not been made yet is left out and named.

When your clients want to read their findings in a portal of their own, moving to Pental takes everything across. And what a penetration test report should contain is worth reading whichever tool writes yours.