PDF Reports

Why the Report Matters More Than the Pentest

A penetration test without a clear report is just a list of technical observations. The report is the deliverable - the artifact that security teams present to executives, compliance auditors, and engineering leads. TurboPentest generates PDF reports designed to serve all three audiences in a single document.

Every report follows a consistent structure that separates strategic context from technical detail. This ensures that a CISO can read the first few pages and understand the risk posture, while a developer can jump to a specific finding and get the exact evidence and remediation guidance to verify their fix.

Report Structure

Cover Page and Scope

The cover page includes the target URL, the source code repository (when one was provided), the completion date, a unique report identifier (TP- followed by the first eight characters of the pentest ID), the prepared-for name and company, and a confidentiality notice. The report identifier ties the report to its blockchain attestation, which is covered in Module 4.

A dedicated Disclaimer and Scope section follows, capturing the testing type (white-box assessment when a source code repository was included, black-box otherwise), the testing window (start and completion timestamps), and explicit limitations such as no denial-of-service testing. A Methodology section documents the standards the pentest follows: PTES, NIST SP 800-115, the OWASP Testing Guides, and MITRE ATT&CK (or ATLAS for AI/LLM targets), among others.

Executive Summary

The executive summary is written for non-technical stakeholders. It answers three questions in plain language: What did we test? What did we find? What should you do first?

The summary page includes a findings-by-severity breakdown (counts of critical, high, medium, low, and info findings) and, when critical or high findings exist, a Recommended Priority Actions list: critical findings require immediate remediation (within 24 hours) and high findings should be remediated within 7 days.

TurboPentest's AI generates the executive summary narrative by analyzing all validated findings and the target's context. This produces a narrative that reads like a human consultant wrote it, because the same reasoning engine that found the vulnerabilities also understands their business implications.

Threat Model Overview

The threat model section provides STRIDE-based threat analysis. Findings and target context are mapped into the six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), each with identified threats and recommended mitigations.

The section also documents automation limitations - areas that require manual testing - along with business logic areas rated by risk level, and a table of prioritized improvement recommendations ranked with effort estimates. This gives risk-based prioritization that goes beyond individual CVSS scores.

Technical Findings

Each finding in the technical section follows a standardized template:

• Title and Severity - A descriptive title with severity label and CVSS score and vector
• Description - What the vulnerability is and why it matters
• Evidence - Proof of exploit output and screenshot evidence that prove the finding
• Framework Mappings - CWE, OWASP Top 10, OWASP Testing Guide categories, MITRE ATT&CK (or ATLAS) technique IDs, SANS category, and ASVS/MASVS levels where applicable
• Remediation - Specific guidance, plus a pointer to a copy-paste remediation prompt for AI coding assistants available on the web report
• Verification Evidence - Re-analysis verdicts showing whether the finding was independently verified or is tool-reported
• References - Links to CWE entries, OWASP guidance, and relevant CVEs

Findings are sorted by severity, from critical to info. Each finding has a unique fingerprint used for finding continuity tracking across repeat pentests.

Finding Continuity

For targets that have been pentested before, findings carry a continuity status - shown as a status column in the findings summary table and as badges on detailed findings - indicating which findings are new, which were confirmed or carried forward from previous pentests, and which persist after a retest. Findings verified as fixed drop out of the report. This trending data is invaluable for demonstrating security improvement over time to auditors and board members.

Suppressed Findings and Tool Appendix

Findings the user has suppressed as false positives appear in a separate Suppressed Findings section rather than silently disappearing. The Tool Appendix lists the security tools used during the assessment, with a short description and runtime duration for each.

PDF Generation Pipeline

TurboPentest renders reports using a headless PDF generation pipeline. The report content is first assembled as structured data (JSON), then rendered through a React-based template engine that produces consistent formatting, branding, and layout. The final PDF is rendered server-side and stored encrypted at rest.

Generated PDFs are cached in blob storage so repeat downloads are fast; if finding suppressions change the report contents, the PDF is regenerated on demand.

Report Retention and Access

Each report is accessible from the pentest detail page and can be re-downloaded at any time. Reports are also linked to their blockchain attestation, which persists independently - even if the report file is deleted, the attestation anchoring its contents remains on-chain.