What finding cards, CVSS scores and ‘demonstrated impact’ mean, and how to decide the remediation order.
In most organisations a penetration test report is received and put in a folder. Read properly, though, it can steer the security investment plan for the next 12 months. A good report speaks to two audiences: a risk summary for management and remediation steps for the technical team.
Executive summary
The first page should state the overall risk level, finding counts (critical, high, medium, low) and the top three risks. The “worst case” explains concretely what the attacker could reach: for example “starting as an internet user, domain admin was obtained in six hours”.
How to read a finding card
- Title and CVSS: 9.0 and above is critical, 7.0–8.9 high, 4.0–6.9 medium, below that low.
- Affected asset: which URL, IP or service
- Evidence: screenshot, request/response sample, command output
- Business impact: what the technical flaw means for the business
- Recommendation: an actionable and verifiable fix
CVSS alone is not enough
CVSS measures technical severity, not real risk in your environment. A medium finding on an internet-facing system may be more urgent than a high finding on the internal network. Prioritisation must also consider asset criticality, ease of exploitation and compensating controls.
Remediation plan
- Critical findings: within 7 days (or interim protection)
- High findings: 30 days
- Medium findings: 90 days
- Low findings: maintenance cycle
Retesting
A finding should not be assumed closed until it has been retested after the fix. The retest report is the “closed” evidence for auditors and customers.
The goal is not to see problems in the report but to turn each finding into a task with an owner and a date. That is why Surnet reports come with a table that can be imported into Jira and ServiceNow.
The first week after receiving the report
- Assign findings to owners (application team, network team, systems team).
- Apply interim protection (WAF rule, access restriction) to critical findings.
- Hold a closing meeting with the testing team to clarify unclear findings.
- Record findings in the risk register and brief the board.
When planning the next test, remember to widen the scope (new applications, mobile client, cloud) and to verify that vulnerabilities found previously have not returned; continuous improvement is worth more than a one-off report.