Sample VAPT report: an illustrative example with invented data
This sample VAPT report walks through the structure of a BERRY9 report, from the executive summary to the finding pages and the remediation matrix. It is an illustrative sample built on an invented application with invented findings, so every name, address and result on this page is example data.
- Example target
- Example Invoice App
- Example findings
- High, medium, low
- Scoring
- CVSS 3.1 with vectors
- Data
- Invented, illustrative
Last reviewed
Executive report: summary, risk by severity and business impact.
Engineering report: one page per finding, with the CVSS 3.1 vector and a proof of concept.
Remediation matrix: owner, status and retest result for every finding.
How to read it: severity, CVSS vectors and the matrix, explained.
01 / Illustrative sample
What this sample report shows
The sample follows one invented web application test from the summary to the last row of the matrix. The application, its users, its address and its three findings were made up for this page; only the structure is the one BERRY9 reports use.
Illustrative sample with invented example data. No client, no real system and no finding from any BERRY9 engagement appears on this page. The domain example.com is reserved for documentation, so the addresses below cannot point to anyone's real system.
The engagement behind the sample
| Item | Example entry |
|---|---|
| Target | Example Invoice App, an invented web application for sending and paying invoices |
| Address | https://invoices.example.com |
| Test | Web application penetration test |
| Tested as | Signed out, and as billing users in two test organizations, A and B |
| Environment | A staging copy holding test data only |
| Findings | Three: one high, one medium and one low, numbered F-01 to F-03 |
The three parts of the report
Executive report
For management: the scope, the findings, their severity and their business meaning, in one short read.
Engineering report
A page for each finding, written so a developer can reproduce it, understand the impact and apply the fix.
Remediation matrix
One row per finding with its fix, its owner and its status, kept up to date until the last item is closed.
This sample is published as a web page, and a PDF copy is available: download the sample report (PDF).
02 / Executive report
Executive report: summary, risk and business impact
The executive report is written for founders, managers and auditors who will not read the finding pages. In this illustrative sample it gives the verdict, the count of findings by severity and what each finding means for the business, in plain language.
Executive summary, as the sample words it
We tested the Example Invoice App at invoices.example.com as a visitor who is not signed in and as billing users in two customer organizations. We confirmed three findings: one high, one medium and one low.
The high finding matters most. Any signed-in customer could open and edit invoices that belong to other customers by changing a number in the request. It should be fixed first, and the two other findings scheduled after it.
None of the findings needed special access or tools to find, which is why we recommend an automated check for each one in the build, so they cannot quietly return.
Business impact, in the sample's words
Customer data
Through F-01, every customer's invoices, amounts and billing contacts were open to every other customer: a breach of the data the product exists to hold.
Billing integrity
F-01 also allowed changes. An invoice altered by an outsider before payment is a direct route to disputes and lost revenue.
User sessions
F-02 lets a crafted link run script in a user's session, and F-03 lets someone on the user's network intercept a first visit over plain HTTP.
03 / Summary of findings
Summary of findings
The engineering report opens with every finding on one table, highest severity first, each linked to its own page. All three rows of this illustrative sample are invented.
Show details for Summary of findings
| Finding | Business impact | Severity | Recommendation |
|---|---|---|---|
| F-01 · Cross-organization access to invoices | Any customer reads and edits other customers' invoices | HighCVSS 3.1 8.1 | Scope every invoice lookup to the caller's organization |
| F-02 · Outdated front-end library | A crafted link can run script in a signed-in user's session | MediumCVSS 3.1 6.1 | Upgrade to the fixed release and fail builds on known-vulnerable versions |
| F-03 · Missing HSTS header | A user's first visit over plain HTTP can be intercepted | LowCVSS 3.1 3.1 | Send Strict-Transport-Security on every HTTPS response |
04 / Finding F-01
Finding F-01: an authorization flaw (high)
Illustrative sample finding. A classic way for one customer's data to reach another is an API that checks who you are but not what you may open, and this invented example shows how such a finding is written up.
Show details for Finding F-01: an authorization flaw (high)
Sample finding F-01 · Example Invoice App
Invoices of another organization can be read and changed by editing the invoice ID
- Severity
- High
- CVSS 3.1
- Base score 8.1 · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Affected component
- GET and PUT /api/v1/invoices/{invoiceId}
- Tested as
- Billing user, organization A (test account)
Proof of concept
- Sign in as the billing user of organization A.
- Open invoice 1001, which belongs to organization A, and note its ID in the request.
- Repeat the request with ID 2002, an invoice created for this test in organization B: the API returns it in full.
- Send a PUT to the same address with a new due date: the change is saved to organization B's invoice.
PUT /api/v1/invoices/2002 HTTP/1.1
Host: invoices.example.com
Authorization: Bearer <org A token>
{"dueDate": "2026-12-31"}
HTTP/1.1 200 OK (org B invoice saved)
Recommendation
Look up each invoice by its ID and the caller's organization together, so a record from another organization is never found, and answer 404 when it is not. Add an automated test that asks for another organization's invoice and expects a refusal.
Example layout, not client dataInvented example · OWASP Top 10: Broken Access Control
| Field | Example entry |
|---|---|
| CVSS 3.1 vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Description | The invoice API checks that the caller is signed in, but not that the invoice belongs to the caller's organization. A signed-in user who changes the ID in the address reaches the invoices of other organizations. |
| Impact | Any customer of the app could read every other customer's invoices, including amounts and billing contacts, and change them before they are paid. |
| Owner | Back-end team |
| Status in the remediation matrix | Fixed |
| Retest result | Passed: invoice 2002 now returns 404 to organization A |
05 / Finding F-02
Finding F-02: an outdated component (medium)
Illustrative sample finding. An outdated library is easy to miss in a large bundle and easy to fix once found; the finding page names the version, the advisory and the upgrade.
Show details for Finding F-02: an outdated component (medium)
Sample finding F-02 · Example Invoice App
Outdated front-end library with a published cross-site scripting flaw
- Severity
- Medium
- CVSS 3.1
- Base score 6.1 · AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Affected component
- /static/js/vendor-ui.js, invented library version 2.4.0
- Tested as
- Signed out, then a signed-in billing user
Proof of concept
- Read the library name and version from the header of the bundled file.
- Compare that version with the public advisory, which names 2.6.0 as the first fixed release.
- Open the reports page with a harmless test value in the title parameter: the browser runs it as script instead of showing it as text.
GET /reports?title=<test> HTTP/1.1
Host: invoices.example.com
HTTP/1.1 200 OK (test ran as script)
Recommendation
Upgrade the library to 2.6.0 or later, and add a dependency check to the build that fails when a bundled version has a published advisory.
Example layout, not client dataInvented example · OWASP Top 10: Vulnerable Components
| Field | Example entry |
|---|---|
| CVSS 3.1 vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Description | The app bundles an invented front-end library at version 2.4.0. Its public advisory lists every release before 2.6.0 as open to cross-site scripting, and one page passes text from the address bar into the affected function. |
| Impact | A crafted link opened by a signed-in user could run script in that user's session and act as them in the app. The user has to open the link, which keeps the score at medium. |
| Owner | Front-end team |
| Status in the remediation matrix | Fixed |
| Retest result | Passed: the fixed release is bundled and the test value shows as text |
06 / Finding F-03
Finding F-03: a missing security header (low)
Illustrative sample finding. A low-severity finding still gets a full page, so the team that schedules it knows what it costs to leave open.
Show details for Finding F-03: a missing security header (low)
Sample finding F-03 · Example Invoice App
Strict-Transport-Security header is missing
- Severity
- Low
- CVSS 3.1
- Base score 3.1 · AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- Affected component
- https://invoices.example.com, every response
- Tested as
- Signed out
Proof of concept
- Request the home page over HTTPS and read the response headers.
- Confirm that no Strict-Transport-Security header is present.
- In a fresh browser, type the address with http://: the first request leaves unencrypted before the redirect.
GET / HTTP/1.1
Host: invoices.example.com
HTTP/1.1 200 OK
Content-Type: text/html
(no Strict-Transport-Security header)
Recommendation
Send Strict-Transport-Security with a max-age of at least one year on every HTTPS response, and add includeSubDomains once every subdomain serves HTTPS.
Example layout, not client dataInvented example · OWASP Top 10: Security Misconfiguration
| Field | Example entry |
|---|---|
| CVSS 3.1 vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
| Description | The app redirects plain HTTP to HTTPS but never tells browsers to use HTTPS only. A first visit, or a link written with http://, still starts unencrypted. |
| Impact | Someone on the same network as a user, such as public Wi-Fi, could intercept or alter that first request. The attack needs that position and a user who starts on plain HTTP, so the score is low. |
| Owner | Platform team |
| Status in the remediation matrix | Open: planned for the next release |
| Retest result | Not retested yet |
07 / Remediation matrix
Remediation matrix: status and retest result
The matrix turns the report into work your team can track. This illustrative sample shows it after a retest: two findings confirmed fixed, one still open.
Show details for Remediation matrix: status and retest result
The first five columns are filled in when the report is delivered. Status and retest result are the columns that keep changing: your team marks a finding fixed when the change ships, and the retest result records whether testing confirmed it. A matrix that still shows open rows, like F-03 here, is the honest picture of what remains.
| ID | Finding | Severity | Fix | Owner | Status | Retest result |
|---|---|---|---|---|---|---|
| F‑01 | Cross-organization access to invoices | HighCVSS 3.1 8.1 | Scope invoice lookups to the caller's organization; add a refusal test | Back-end team | Fixed | Passed: invoice 2002 now returns 404 to organization A |
| F‑02 | Outdated front-end library | MediumCVSS 3.1 6.1 | Upgrade the library; fail builds on advisories | Front-end team | Fixed | Passed: the fixed release is bundled and the test value shows as text |
| F‑03 | Missing HSTS header | LowCVSS 3.1 3.1 | Add the HSTS header to every HTTPS response | Platform team | Open: planned for the next release | Not retested yet |
How retesting is handled and what each scope includes are covered in the VAPT methodology and the VAPT cost guide.
08 / How to read it
How to read a VAPT report
Three things carry most of the meaning in any report: the severity rating, the CVSS vector behind it and the remediation matrix. Here is how to read each, using the sample's invented findings.
Show details for How to read a VAPT report
Start with the rating, then read the vector. The rating (low, medium, high or critical) comes from the CVSS 3.1 base score, and the bands are set out on the VAPT methodology page. The vector string is the reasoning behind the number: eight short codes that anyone can check, and that a reviewer can challenge one by one if they see the flaw differently.
The table decodes F-01. Compare F-02: its vector says the user has to open a crafted link (UI:R) and that the script runs in the user's browser, beyond the vulnerable server (S:C), with limited effect on data (C:L, I:L). Those three codes are why it rates medium and not high. F-03 needs an attacker on the user's own network and a first visit over plain HTTP (AC:H, UI:R), so it rates low.
| Metric | Value in F-01 | What it says |
|---|---|---|
| AV: attack vector | N, network | The flaw can be reached over the internet |
| AC: attack complexity | L, low | No special conditions have to line up |
| PR: privileges required | L, low | Any ordinary signed-in account is enough |
| UI: user interaction | N, none | No other user has to click or open anything |
| S: scope | U, unchanged | The damage stays inside the invoice app |
| C: confidentiality | H, high | Other organizations' invoices can be read |
| I: integrity | H, high | Those invoices can be changed |
| A: availability | N, none | The service keeps running normally |
Three habits for reading any report
- Read the impact before the score. FIRST's guidance says CVSS measures severity, not risk; the impact paragraph is where the report says what a finding means for your business.
- Check that each finding can be reproduced. A proof of concept with numbered steps and the request and response is what lets your developers confirm the problem before they change any code.
- Use the matrix as the to-do list. Work the open rows from the highest severity down, and treat a finding as closed only when its retest result says so.
09 / Other tests
How reports differ for other tests
Every BERRY9 test beyond the starter scope ends with the same three parts. Each kind of test then adds the material its readers need, taken from the deliverables of that service.
Show details for How reports differ for other tests
- Network tests add a topology diagram of the path the testers took, findings host by host, and MITRE ATT&CK mapping.
- Active Directory tests add a hygiene checklist for tier zero, meaning the accounts and settings with control over the domain.
- Mobile app tests cross-reference static and dynamic findings with OWASP MASVS and add a hardening guide for the build pipeline.
- API tests add an endpoint coverage map with the authorization tests run against it, and reproductions you can replay.
- Source code reviews point every finding to its file, line and commit, and add a list of patterns to search for in pull requests.
- Web application tests add coverage by category against the OWASP Top 10 and ASVS; this sample leaves that table out to stay short.
The specialist services use the same executive report, finding pages and remediation matrix; what each adds is set out on its own page:
All services appear, grouped, on the offensive security services page. To discuss a report for your own systems, contact BERRY9.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
What does a VAPT report contain?
A BERRY9 report for any test beyond the starter scope has three parts. The executive report gives the summary, the findings by severity and the business impact. The engineering report gives each finding a page with its title, severity, CVSS 3.1 vector, affected component, description, proof of concept, impact and recommendation. The remediation matrix tracks every finding's owner, status and retest result until it is closed. See the section on What this sample report shows above.
Is this sample report taken from a real client?
No. The Example Invoice App, its address, its users and its three findings were invented for this page. No client, no real system and no vulnerability from any engagement appears in it; only the structure matches the reports BERRY9 delivers.
What is the difference between the executive report and the engineering report?
The executive report is for management and auditors: the scope, the results, how severe they are and the business consequences, without technical detail. The engineering report is for developers: each finding with its CVSS 3.1 vector, the steps and evidence to reproduce it, and the fix. See the section on Executive report: summary, risk and business impact above.
What does a CVSS 3.1 vector string mean?
It is the list of metric values behind a CVSS 3.1 score, such as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. Each code records one judgment: how the flaw is reached, how hard it is to exploit, what access and user action it needs, whether its effect spreads beyond the vulnerable component, and its impact on confidentiality, integrity and availability. See the section on How to read a VAPT report above.
What is a remediation matrix in a VAPT report?
It is a table with one row per finding: its ID, severity, fix, owner, status and retest result. The team that fixes the findings works through it in order of severity, and it shows at any moment which findings are closed and which are still open. See the section on Remediation matrix: status and retest result above.
What should a proof of concept in a report show?
Enough for a developer to see the problem for themselves: the account or role used, numbered steps, the request sent and the response that proves the result, and what an attacker would gain. A finding without that evidence is hard to confirm and easy to dispute. See the section on Finding F-01: an authorization flaw (high) above.
Can a VAPT report be used as audit evidence?
Penetration test reports are commonly filed as evidence for audits and customer security reviews, but the auditor or customer decides what they accept. BERRY9 tests; it does not certify, audit or decide what an auditor accepts. Send the auditor's written requirement before scoping, so the test covers what they expect.
Do all BERRY9 reports follow this layout?
Every test beyond the starter scope ends with the executive report, the finding pages and the remediation matrix, and the starter scope ends with a written report. Each kind of test adds its own material: network tests add a topology diagram and MITRE ATT&CK mapping, mobile tests map findings to OWASP MASVS, and source code reviews point each finding to its file and line. See the section on How reports differ for other tests above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana