A VAPT report is the deliverable of a vulnerability assessment and penetration test. It tells leadership how much risk exists and tells engineers exactly what to fix. Below is the structure of an Aesparrow report and an example finding written in the same format our clients receive.
Structure of a penetration testing report
- Document control. Version, dates, authors, reviewers, distribution list and confidentiality marking.
- Executive summary. One-page, non-technical overview: overall risk posture, count of findings by severity, key business risks and top recommendations.
- Scope and rules of engagement. In-scope targets (URLs, apps, APIs, IP ranges, cloud accounts), exclusions, test type (black/grey/white box), accounts used and testing window.
- Methodology. Standards followed — OWASP WSTG/ASVS/MASVS, OWASP API Top 10, PTES, NIST SP 800-115 — and the tools and manual techniques used.
- Risk rating model. How severity is calculated (CVSS v3.1 or v4.0 base score, adjusted for business impact and likelihood).
- Findings summary. A table of every finding with ID, title, severity, CVSS, affected asset and status (open, fixed, accepted).
- Detailed findings. For each issue: description, affected components, steps to reproduce, evidence (redacted screenshots, requests/responses), impact, CWE/OWASP mapping and remediation.
- Compliance mapping. Optional mapping of findings to ISO 27001 Annex A, SOC 2 criteria, PCI DSS requirement 11.4, HIPAA or other controls.
- Re-test results. Status of each finding after remediation, with retest date and evidence.
- Appendices. Tool output, list of tested endpoints, positive observations and glossary.
Example finding (fictional, for illustration)
- ID
- WEB-003
- Title
- Broken object level authorisation (IDOR) on invoice download
- Severity
- High — CVSS v3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
- Affected asset
- GET /api/v1/invoices/{id}/pdf on app.example.com
- Mapping
- CWE-639; OWASP API Security Top 10 API1:2023; OWASP Top 10 A01:2021
- Description
- The endpoint returns an invoice PDF for any numeric ID without checking that the invoice belongs to the authenticated user's organisation.
- Steps to reproduce
- Log in as a user of Tenant A, request an invoice you own, then change the ID to one belonging to Tenant B. The server returns Tenant B's invoice.
- Impact
- Any customer can download other customers' invoices, exposing names, addresses and billing data.
- Remediation
- Enforce an ownership check on the server for every object request, use non-sequential identifiers, and add automated authorisation tests to CI.
- Re-test status
- Fixed — verified on re-test
How findings are rated
- Critical (9.0–10.0): remote compromise or mass data exposure; fix immediately.
- High (7.0–8.9): significant data access or privilege escalation; fix within days.
- Medium (4.0–6.9): exploitable with conditions; fix in the next release cycle.
- Low (0.1–3.9): limited impact; fix as part of hardening.
- Informational: best-practice observations with no direct risk.
Request a redacted sample report
Contact us to receive a redacted sample report. You can also read what is in a VAPT report, our VAPT methodology and how we price engagements.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
What should a VAPT report include?
A good VAPT report includes an executive summary, scope, methodology, risk rating model, a findings summary table, detailed findings with evidence and CVSS scores, remediation guidance, compliance mapping where needed, and re-test results.
Can I download a full sample penetration testing report?
Client reports are confidential, so we share a redacted sample report on request after a short call. Contact us and we will send it along with a scoping questionnaire.
Do you provide a VAPT certificate or attestation letter?
Yes. After re-testing we issue an attestation letter summarising the scope, dates and outcome, which you can share with customers, auditors or partners. It is not a certification by an accredited body.
Is the report accepted for ISO 27001, SOC 2 or PCI DSS audits?
Our reports are written to be used as audit evidence and can map findings to ISO 27001, SOC 2, PCI DSS and HIPAA controls. Acceptance is always at the discretion of your auditor or assessor.