Capstone — Pentest Report with Remediation Plan

What You'll Deliver

This is the capstone deliverable: a professional penetration test report for the vulnerable application you assessed, complete with an executive summary, detailed findings, severity scoring, evidence, and a prioritised remediation plan backed by your re-test results. It is the artifact that a real client pays for and a development team acts upon, and it demonstrates command of the entire course.

Analogy🏏Cricket

💼 Think of it like business: A consulting engagement is not judged by the work done in the field but by the final report on the executive's desk, the summary of risk, the detailed findings, the priorities, and the plan of action the client actually pays for. Just as that report is the tangible product the whole engagement exists to produce, your penetration test report, with its executive summary, scored findings, evidence, and prioritised remediation plan, is the artifact this capstone exists to produce. This reveals the deliverable's weight: it is what a real client buys and a development team acts upon.

The aim is to communicate, not just to catalogue. A strong report serves two audiences at once: executives who need to understand business risk and priorities, and engineers who need precise, reproducible detail to fix each issue. You will assemble the evidence from all four prior phases into a document that turns your technical work into clear, actionable decisions.

Analogy🏏Cricket

🏏 Think of it like cricket: A great post-tour report does not just catalogue every delivery; it speaks to two audiences at once, giving the board the plain verdict on where the team stands and handing the coaches the precise, repeatable detail they need to change training. Just as that dual-purpose report turns a season of play into decisions both rooms can act on, your pentest report must serve executives who need business risk and engineers who need reproducible detail, assembling every phase's evidence into clear action. This reveals the writer's aim: communicate for both readers, not merely record.

Prerequisites

Your complete engagement log, attack-surface map, confirmed findings list, and re-test results from Lessons 31–34.
Completion of the Module 5 lesson on CVSS and triage, whose severity scoring you will apply to each finding.
A writing tool for the report, and any evidence (screenshots, request/response captures) collected during the engagement.
An understanding that the report documents testing performed only on your authorised local capstone application.

Report Structure & Approach

A professional report follows a recognisable structure so readers can navigate it quickly: an executive summary, an engagement overview with scope, a findings section with one entry per vulnerability, and a prioritised remediation plan. Assemble it from the artifacts you already produced, your findings become the findings section, your re-tests become evidence of remediation, so writing is largely organising and communicating work already done.

Analogy🏏Cricket

⚽ Think of it like sports: A match report follows a shape every reader expects, the headline result first, then the key moments, then the tactical detail, so a fan and a coach can each find what they need at a glance. Just as that familiar structure lets different readers navigate the same report quickly, a pentest report's executive summary, engagement overview and scope, findings section, and remediation plan let executives and engineers each find their part fast. This reveals why structure helps: with the shape fixed, writing becomes organising the artifacts you already produced, not generating them anew.

bash

# Report skeleton (assemble from your prior artifacts)
# 1. Executive Summary      — plain-language risk overview + top priorities
# 2. Engagement Overview    — scope, rules of engagement, methodology, dates
# 3. Findings               — one entry each: title, severity (CVSS), impact,
#                             evidence, reproduction steps, affected endpoint
# 4. Remediation Plan       — prioritised fixes, owners, timelines, re-test status
# 5. Appendices             — engagement log, attack-surface map, evidence
#
# Sources: engagement_log.csv, attack_surface.md, findings list, remediation.md