# Professional Penetration Test Report

## Cover Page
- Client:
- Assessment name:
- Assessment dates:
- Report date:
- Version:
- Prepared by:
- Distribution list:

## Confidentiality Notice
This report contains sensitive security information from an authorized
assessment. Distribution is limited to approved recipients.

## Executive Summary
Summarize the overall security posture, key business risks, and highest-priority
remediation themes in plain language.

## Scope and Methodology
- In-scope assets:
- Out-of-scope assets:
- Testing windows:
- Accounts and roles used:
- Tools and versions:
- Constraints and assumptions:

## Risk Rating Method
Define severity using likelihood, impact, exploitability, compensating controls,
and asset criticality. Include CVSS where applicable but explain business risk.

## Findings Summary
| ID | Title | Severity | Affected Asset | Status |
|---|---|---|---|---|
| ND-001 |  | High / Medium / Low |  | Open |

## Detailed Finding: ND-001
### Title

### Severity

### Affected Assets

### Description

### Evidence
Use redacted screenshots, logs, request metadata, or hashes. Avoid secrets and
unnecessary personal data.

### Impact

### Safe Reproduction Steps

### Remediation

### Retest Procedure

### References

## Positive Observations
Document controls that worked well and reduced risk.

## Appendix A: Tool Output Index
| Tool | Output File | Hash | Notes |
|---|---|---|---|

## Appendix B: Timeline
| Timestamp UTC | Activity | Analyst |
|---|---|---|