Writing a Pentest Finding from Your Notes with AI

The slowest part of a test is rarely the testing. It is turning a page of rough notes, a terminal session and a dozen screenshots into a finding a client can act on. In Pental the notes are the starting point: you paste what you have, and the finding is drafted from it, field by field, in the way your firm writes. You stay the author. Every field can be edited, rewritten to an instruction, or written by hand.

Start with the evidence

Open the engagement, press Add Finding, and paste into the Evidence editor: the notes you took, the command you ran and what came back, the request and the response, and the screenshots. Pasted screenshots land as images in the editor, in the place you pasted them, so the evidence reads in the order you found things.

Nothing else needs filling in first. A title is not required to start, and neither is a severity: both are drafted from what you pasted.

One press drafts every field

Generate all from evidence fills every empty field of the finding from that evidence, several at once and in the order they depend on each other:

• The title, unless you have already given it one.
• The description, written to your firm’s prompt for descriptions, so it reads like your reports rather than a generic write-up.
• The remediation: what to change, in the terms the people fixing it work in.
• The CVSS score with the vector it was calculated from, and the severity that follows from it, so the metrics behind the number can be opened and checked rather than taken on trust.
• The CWE and the category, the category chosen from your own list.
• The affected assets, read out of the evidence.
• The references, looked up from what the finding now says, with their links checked.
• Every field your firm has added of its own, each to its own prompt.

If your Library already holds a finding with that title, your agreed wording fills what it can rather than being written again, which keeps the same issue reading the same way across clients. A run can be stopped part way, and the whole run undone from the message it ends with.

The evidence comes back tidied

The same run works through the evidence itself. A line above each screenshot, request, block of code or output says what it shows, each screenshot gets a caption for the report, and your own notes are tidied with every value in them kept exactly as you wrote it. A line or caption somebody changes by hand is theirs, and is kept when AI is asked again. Explain evidence, beside it, does this part on its own.

Not quite right? Say what to change

Beside each Generate is a small button with three sliders. It opens a box for your own words: "shorter", "mention the support portal is internet-facing", "write the remediation for a Windows team". The field is rewritten to that instruction, starting from what it says now rather than from scratch, so the parts you were happy with stay.

Each field’s prompt is your firm’s to change, under Settings, Findings, beside the field it writes. A firm that wants remediation as numbered steps, or descriptions that open with the business impact, says so once there, and every finding follows.

Save it and get back to testing

The dialog’s buttons say what they leave the finding as. Save (Ctrl+S, or ⌘S on a Mac) saves and keeps the dialog open. Save as draft and close saves a half-finished finding, required fields and all left for later. Save as final and close saves it finished, and asks for any required field first. A new finding saved with Save and then closed is a draft, unless your firm has chosen Final under Settings, Findings, New findings are saved as.

Saving as a draft is how a tester keeps testing instead of switching to reporting: the finding is recorded, it is clearly unfinished, and the write-up can be tidied later. Live reporting covers showing a draft to the client while the test is still running.

Whose model it is

The model is yours. Use your own key for OpenAI, Anthropic or Groq, stored encrypted in your own database, or run a local model on your own hardware so nothing leaves your network. Connecting an AI provider covers each, and running AI drafting on hardware you own covers the local option. With your own key or a local model, neither the key nor the evidence passes through Pental.

If your clients ask how AI is used in their reports, AI in pentest report writing: a policy clients will accept is a good place to start the conversation.