Writing the Report and Recommendations
Write a professional pentest report: expected structure, evidence, impact rating, and prioritized recommendations for the client.
🟩 Reporting · Cycle: 7. Report HTB Academy: Documentation & Reporting
Objectives
- Write a professional pentest report.
- Translate technical findings into prioritized recommendations.
Why the report is the real deliverable
A client doesn't pay for you to "hack" their system — they pay to know what to fix. The report is therefore the final product that carries value: it turns hours of exploitation into concrete security actions. A brilliant but poorly documented pentest is useless. Knowing how to write a good report is, in fact, the most employable skill in the field.
Course (1 h 20)
- Structure: executive summary, methodology, findings, evidence, remediation, appendices.
- Two audiences: leadership (impact/risk) vs. technical (reproduction/fix).
- Risk rating (CVSS + business context).
What is an "executive summary"?
The executive summary is a one-page section at the beginning of the report, intended for non-technical executives. It answers three questions without jargon: What is the overall risk? What are the priorities? How much could it cost to do nothing (or to fix it)? No commands, no obscure terms — you talk about business impact and budget. It's often the only part that leadership reads, which makes it the most strategic one.