The Executive Summary and the Rest of the Report’s Sections

A report is more than its findings. The executive summary is the page most of its readers will ever read, and the caveats, the retest summary and whatever sections your firm always includes are what make it yours. In Pental each of them is written on the engagement, next to the findings it draws on, and each can be drafted by AI to its own prompt.

The executive summary

On the engagement, Generate / Edit beside Executive Summary opens its editor, and Generate with AI drafts it from every finding on the engagement and the notes you kept, ready for you to edit. To the built-in prompt it opens with who tested what, for whom and when, and how many findings there were at each severity; takes each category of finding in turn, the most severe first, in terms a director can follow; and ends with the remediation to put first.

Under Settings, Assessments, Executive Summary Structure decides how an engagement with several phases is summarised: one unified summary grouped by category, or a section for each phase. A single-phase engagement is always one summary.

For what makes one worth reading, see writing a pentest executive summary that gets read.

Caveats, the retest summary and sections of your own

The rest of the report is written in the same place. Caveats records the limits the testing worked within. The Retest Summary says what was checked again and what was found. And any section your firm adds, an attack path, a remediation roadmap, a note on methodology, appears on every engagement as a card of its own, after the executive summary or wherever you place it.

Each one that is text can be drafted by AI to a prompt of its own, from the engagement’s findings and details, and rewritten to an instruction the same way a finding’s fields can. A section can also be a value rather than a passage: a dropdown, a choice of several, yes or no, a date or a link, answered in its own control.

Marking a section as a draft

Every section has a Draft switch, and its editor saves the way a finding’s does: Save keeps writing and leaves the mark as it was, Save as draft and close marks it as still being written, and Save as final and close clears the mark. Downloading the report never asks about drafts, so it can be read and reviewed as it stands; it is delivery to the client that waits until every section is final.

What the client sees of each section

Each section also has a Client Visible switch on the engagement. Your firm sets the default for each section, and any engagement can differ: an attack path you share with one client can stay internal for another. Notes are your team’s working notes and are internal by default.

Your sections, in Settings

Settings, Assessments, Assessment Sections lists every section of an engagement in order. For each one:

+ Add Section adds one of your own, with its heading, its style and an AI prompt of its own. Each section of your own also has a placeholder, {custom_summary_…}, for a Word template that sets out exactly where it goes; one you do not place is added after the executive summary. Making your Word template the one Pental fills covers the template side.

The engagement’s title, to a prompt too

On the same screen, Assessment Title holds the prompt for Generate beside an engagement’s title, which writes it from the client and the phases being tested. Without AI the title is made from the phases.

For the order a whole report is best written in, see how to write a penetration test report and what a penetration test report should contain.