Plain English
What to do after a penetration test
The weeks after a penetration test decide whether it was worth the fee. The report alone changes nothing. So this guide explains the steps that turn findings into fixes, and fixes into evidence.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
The first week after a penetration test
Read the summary first. It tells you the overall picture and anything urgent. Then share the findings with the owners of the affected systems, using your named report list.
Also hold the debrief while the work is fresh. Because the testers can answer questions directly, it saves weeks of email.
Assigning fixes after a penetration test
Give each finding an owner and a date. Start with the most serious ones, but do not ignore quick wins. Several small fixes often close a whole chain.
If a fix cannot happen soon, record that decision in writing. Then the risk is accepted by a named person rather than forgotten.
| Step | Owner | Output |
|---|---|---|
| Read the summary | Security lead | Urgent items flagged |
| Debrief | Security lead and engineers | Questions answered |
| Assign fixes | System owners | Owner and date per finding |
| Record exceptions | Business owner | Written risk decision |
| Retest | Testing firm | Confirmation of fixes |
After a penetration test checklist
Tick each step you have completed.
Your result appears here as you tick, so you can see what is still open.
The retest after a penetration test
Once the fixes are in, the firm checks them. The result is usually a short letter or an updated report showing what is now closed.
So book the retest when you assign fixes. A date on the calendar keeps the work moving.
Sharing results
Customers and auditors rarely need the full report. A summary or attestation letter is often enough. Because the full report lists weaknesses, share it only when there is a clear need.
In addition, keep the signed scope with whatever you share. It shows exactly what was tested.
Filing the evidence
Keep the scope, authorization, report, retest result and any risk decisions in one folder. Next year, that folder is the starting point for the new scope.
Finally, note what you would change about the process. As a result, the next engagement runs more smoothly.
Our part after a penetration test
The practitioner who ran the work leads the debrief, and the retest confirms your fixes. Then the evidence is yours to keep and share.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
After a penetration test: questions
What should happen first after a penetration test?
Read the summary, flag anything urgent and book the debrief.
When is the retest?
Once the fixes are in. Book it when you assign them.
Who sees the report after a penetration test?
Only the named list. Customers usually receive a summary or letter.
What do we keep?
The scope, authorization, report, retest result and risk decisions.
Related guides
Plan what comes after a penetration test
Send a short brief. We reply with a written scope that includes the debrief and retest, and a fixed fee.
Ask about authorised testing