Penetration test report template (free)

Page 1 of 13

Page 2 of 13

Page 3 of 13

Page 4 of 13

Page 5 of 13

Page 6 of 13

Page 7 of 13

Page 8 of 13

Page 9 of 13

Page 10 of 13

Page 11 of 13

Page 12 of 13

Page 13 of 13

What’s inside the Penetration Test Report.

13 pages with real content in place. Rewrite them, reorder them, or add your own.

1Page 1A white cover with the verdict as the title, a line drawing of every endpoint tested with findings marked by severity, and the engagement details
2Page 2Summary: three KPIs against the last test, overall risk before and after retest, the findings that matter most and the estimated upside
3Page 3Scorecard: eight areas with their status after retest, findings and a one-line reason
4Page 4Action plan: eight ranked fixes with impact, effort, owner and date, quick wins first
5Page 5Attack path: five steps from a free trial account to other companies' payslips
6Page 6Finding TDW-01, critical: why it matters, the fix, how to check it and the request that proved it
7Page 7Findings TDW-02 and TDW-03, high: SQL injection and server-side request forgery
8Page 8Findings TDW-04 and TDW-05: reusable reset links and admin sign-in without MFA
9Page 9What held up: four controls that resisted testing, with evidence
10Page 10Retest: status counts, the five open findings with owners and dates, the verified fixes and retest evidence
11Page 11Roadmap: the actions in three time bands and the one decision needed now
12Page 12Method and scoring: scope, roles, standards, the likelihood and impact matrix and what was not checked
13Page 13Appendix: every finding with its CVSS vector and score, and the testers' attestation

When to use it.

Penetration Test Report is a 13-page A4 report for security testers delivering results on a web application and API. It opens with overall risk before and after retest, a scorecard by area and an eight-step action plan with quick wins first, then shows the attack path and each finding as a card with its CVSS score, the fix and the request that proved it. What held up, retest status, a roadmap, method and an appendix with every vector and the attestation follow. Navy line drawings and a monospaced type for IDs keep it technical.

Made for

Agencies reporting to clients
Consultants and freelancers
Founders updating a board
Teams sharing results

Make it yours in four steps.

Open it in Reports and work through it, or let Docsiv AI do the first pass with your details.

Step 1
Replace the client, the application, the test dates and the verdict on the cover.
Step 2
Rewrite the finding cards with your own IDs, severities, CVSS vectors and evidence.
Step 3
Update the attack path, scorecard, action plan and retest status.
Step 4
Complete the method and the testers' attestation, then share the report as a link or PDF.

Start from the Penetration Test Report now.

Questions about this template.

Something else on your mind? Ask us in the chat, bottom right of the page.

Is the Penetration Test Report template free?

Yes. Create a free account and it opens in Docsiv's Reports app, ready to edit and share. The Free plan includes every Docsiv app and 500 AI credits a month.

Can I change the colours, fonts and text?

Yes, all of it. The template uses IBM Plex Sans and IBM Plex Mono with #ffffff, #13254a, #4d6a96, #d3dbe7, #d0362f, and you can change any of them, rewrite every word and add or remove pages.

What can I export it as?

Reports in Docsiv offers: Report pages with charts, PDF and HTML exports. Once it's saved, you can also share it with a link.

Can Docsiv AI write the penetration test report for me?

Yes. Tell Docsiv AI about the client or project and it can draft the content in this template's style, which you then review and edit. AI uses credits; the Free plan includes 500 a month.

All report templates