Customer Asked for a Pen Test Report? What to Send

The buyer wants proof that someone independent has tried to break your product and that you fixed what they found. They are checking four things:

• That a test was done by a party other than your own developers.
• That it covered the product they will use, not just your website.
• That it is recent, usually within the last twelve months.
• That serious findings were fixed, and the fixes were checked.

Most vendors do not send the full report, because it describes weaknesses in detail. Common options, from lightest to fullest:

1. An attestation letter. One page from the testing firm: who tested, when, what scope, which method, and the summary of results and retest status.
2. An executive summary. The management section of the report, with details removed.
3. The full report under NDA, usually for large customers or regulated buyers, shared through a secure portal or a screen share.

Ask the testing firm to prepare an attestation letter at the start of the engagement. A good report has an executive summary written to be shared. Our sample VAPT report shows the structure.

• Clear scope: exact applications, versions, environments and test dates.
• A named method, such as OWASP-based web testing, with the standard it follows.
• Findings with severity, evidence and fix guidance.
• A retest section that shows what was fixed and what remains.
• The testing firm's name and contact details.

• A scan labeled as a pen test. Buyers who know the difference will ask for the method.
• An old report. A test from three years ago on a product that has been rewritten does not help.
• Open critical findings with no plan. Buyers accept that testers find issues. They do not accept that nothing was done.
• Testing only the marketing site. The buyer cares about the product and its API.

Questionnaires often ask for more than a report: SOC 2 or ISO 27001 status, a vulnerability management process, an incident response plan, encryption details and a list of subprocessors. A penetration test supports several answers at once. See how it fits SOC 2 and ISO 27001 programs. Some buyers name a CERT-In panel auditor for specific engagements. We explain that in do you need a CERT-In empanelled auditor, and we tell you before you pay whether a requirement needs one.

1. Test the product your customers use, with its API, at least once a year and after major releases.
2. Agree with the testing firm that you will receive a shareable summary and an attestation letter.
3. Fix critical and high findings, then retest, and keep the retest evidence.
4. Keep a one-page security overview with your test date, scope and results.
5. Decide in advance who may share reports and under what terms.

If a customer has already asked, tell us the product, the deadline and the wording of their request, and we will scope a test that answers it. See web application testing, API testing and mobile app testing, or request a scoping call.