You've got the pen test report. Now what?

The report lands, it's forty pages, and it has three criticals, eleven highs, and a long tail. Then it goes into a tracker and the next test finds most of the same things.

Read it differently

A penetration test isn't a list of vulnerabilities. It's a story about how an attacker would move through your environment. The criticals matter, but the more useful question is: what chain did the tester use to get from outside to something that matters, and which single link in that chain, if fixed, breaks it?

Often that link isn't a critical. It's a medium that happened to connect two things.

Three things to do in the first week

• Fix the chain-breakers first. Not the highest severity; the findings that remove the most attack paths.
• Ask what the tester couldn't do. Scope exclusions, time limits, and "we stopped here because we proved the point" are the parts of the story you didn't pay for and most need to know.
• Turn each finding into a detection question. If the tester did this and nobody noticed, that's a second finding, and arguably the bigger one.

What to tell the board

Not the count. Boards don't learn anything from "eleven highs." They learn from "an outside attacker could reach our customer database in two steps; we've closed the first step this week and the second is scheduled; here's how we'd know if someone tried." That sentence makes the test worth what it cost.

The pattern to break

If the next report finds the same things, the problem isn't the findings. It's that nobody owns closing them. Give each chain an owner and a date, and retest only that chain before the next full test. It's cheaper and it proves something.

If you've got a report you're not sure what to do with, send me the summary and I'll tell you where I'd start.

Explore: More on governance and risk · Work with me