Lion Cipher Lab
Run a penetration test readout and handle disputed findings
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
The report is not the end of a penetration test. The readout is: the meeting where the tester walks the client through the results. It is where findings are understood or misunderstood, where severities get challenged, and where owners and dates are agreed, or quietly not agreed. NIST SP 800-115 treats post-testing activity, including reporting and recommending mitigations, as part of the assessment, and the UK NCSC's guidance describes what a customer should expect from the report and the engagement. Two things go wrong in readouts. The tester gives in to pressure, removing or downgrading…
What you'll learn
- planning a readout for two audiences: leadership and engineers
- presenting findings so the risk lands, not just the list
- telling new evidence apart from pressure
- when to change a finding, and when to hold
- recording disputed findings honestly
- agreeing owners, dates and a retest
- keeping the tester's independence
Steps in this lab
- What the readout is for
- Plan the meeting
- The test: new evidence, or pressure?
- Drill five pushbacks
- Answer key
- Close the meeting, and protect your independence