Lion Cipher Lab
Evaluate penetration test reports with a quality rubric
- Penetration Testing / Red Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Organizations buy penetration tests to find out how exposed they are, and the report is the only thing they keep. Yet reports are often judged by size. A thick report with many findings feels like more value, so procurement and management tend to favour it. In reality, length often comes from pasting raw scanner output: dozens of unverified, generic findings with no reproduction steps, which developers cannot act on and auditors cannot rely on. NIST SP 800-115 describes what assessment reporting should cover. The PCI Security Standards Council's penetration testing guidance lists the expected…
What you'll learn
- what a usable penetration test report must contain
- building a weighted rubric with must-have criteria
- scoring reports consistently with evidence notes
- why page and finding counts mislead
- spotting unverified scanner output in a report
- using a rubric in vendor selection and acceptance
- the limits of scoring a report rather than the test
Steps in this lab
- What a report owes its reader
- The rubric and three reports
- Write the scorer
- Run it and compare the rankings
- What a report rubric cannot see