ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Validate insights →Sharing penetration test results with customers
Give customers useful assurance while protecting technical detail, third-party information and the meaning of the original scope.
Give customers useful assurance while protecting technical detail, third-party information and the meaning of the original scope.
Need an acronym translated?Open the cyber glossary →Find out what the customer needs to decide
A customer may need to confirm that testing happened, understand an unresolved risk, or assess a service before onboarding. Ask which question the evidence must answer and who will review it. Sending a complete technical report by default can disclose much more than necessary without resolving the actual procurement or assurance decision.
Describe the assessed service and date
State which service, application version, environment and boundary were tested. Include the relevant assessment period and delivery model. Avoid allowing a report on one component to imply coverage of a wider group or a later deployment. If the customer relies on a specific integration or data flow, make clear whether it formed part of the assessed scope.
Choose the right evidence package
An executive summary, assessment confirmation, scope statement or controlled technical extract may be appropriate, depending on the request and agreement. Keep severity, material limitations and the status of important findings understandable. A short assurance note should not selectively remove information that changes the risk picture. Confirm whether a provider-issued confirmation or customer-specific briefing is required.
Redact with a clear purpose
Review credentials, personal information, internal addresses, implementation detail and third-party material before sharing. Use a controlled copy, preserve its relationship to the full report, and record what was removed. Do not rewrite a finding so that it appears resolved when it remains open. Where disclosure terms apply, agree the recipient, transfer method and onward-sharing restrictions before release.
Show what changed after the test
A customer often gains more confidence from an evidenced remediation record than from an unexplained report date. Link material findings to actions and retest outcomes. Distinguish fixes verified by further testing from decisions accepted without a retest. Keep the scope of each follow-up clear so evidence about one correction does not become a claim that the whole environment was retested.
Keep the message accurate and usable
Name the evidence owner, version the shared package and provide a route for sensible follow-up questions. Testing gives bounded evidence; it is not a promise that every vulnerability has been found or that future changes are covered. Use the Portal where agreed to keep scope, findings, evidence and remediation progress connected, while choosing the appropriate information to share with each audience.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Modern penetration testing should create decisions, not just findings” →
