Keep technical severity beside the bounded impact
A penetration testing report should make its severity reasoning inspectable. The score helps organize a finding, but the engineering and business decisions also need the affected behavior, exposure, evidence, and limits of the assessment.
Preserve the reasoning behind the number
When using CVSS, include the applicable version, vector, and rationale. FIRST's CVSS v4.0 specification defines the scoring framework. Another reviewer should be able to understand which assumptions produced the selected metrics rather than reverse-engineer a bare number.
Do not adjust a score simply to make a finding appear urgent or to reduce friction in a repair queue. If the report uses a different prioritization scheme, name it and explain what the label represents. Technical severity and the organization's delivery priority need not be the same field.
Describe what the evidence actually established
Use a bounded impact statement. In an illustrative tenant-export case, the evidence may establish that one restricted test account retrieved another synthetic tenant's export. It does not automatically establish access to every record, compromise of an administrator, or exploitation before the assessment.
Explain the prerequisites. The reader needs to know whether an attacker requires an account, a specific role, knowledge of an identifier, or access to a limited environment. Those facts can materially change the operating decision without making the observed flaw disappear.
Explain chains without double counting
Some impacts require several weaknesses to be combined. Identify which step supplies access, which step crosses a boundary, and what the combined observation proves. Keep the individual findings linked to the chain rather than presenting every step as independently producing the maximum impact.
A failure to reproduce one step should change the confidence in that chain. It should not silently turn into an assertion that the final result was confirmed anyway. Preserve successful and incomplete observations separately.
Give the repair owner a usable decision
Add the affected component or rule, the responsible team, the proposed acceptance condition, and any required follow-up investigation. Avoid unsupported monetary estimates or a claim that a particular report automatically satisfies an auditor. The intended recipient's actual requirements still need confirmation.
The category guide shows an original example record. Use the review procedure to establish its evidence and the repair-acceptance guide to keep the later decision comparable. The directory distinguishes public examples from commissioned assessments so their purposes remain clear.
Continue reading
Cite this entry
Penetration Testing Reports. “Keep technical severity beside the bounded impact.” Reviewed November 12, 2026.
https://penetrationtestingreports.com/severity-and-impact/