Report writing is exactly as it sounds and is one of the most important elements of any penetration test. Penetration testing may be the service, but report writing is the deliverable that the client sees and is the only tangible element given to the client at the end of the assessment. Reports should be given as much attention and care as the testing.

I will cover report writing in greater detail later in the book, but report writing involves much more than listing a few vulnerabilities discovered during the assessment. It is the medium in which you convey risk, business impact, summarize your findings, and include remediation steps. A good penetration tester needs to be a good report writer, or the issues they find will be lost and may never be understood by the client who hired them to conduct the assessment.

Having completed this section, you are now able to describe each phase of a penetration test. Furthermore, you have a better idea of the expectations of penetration testers in the industry. Next, we will dive into understanding various penetration testing methodologies, standards, and frameworks.