Practical Security Automation and Testing

Approach 2 – generate a professional pentest report with Serpico

A summary of the security testing documentation will help you to communicate with stakeholders. The report should not only list the security findings but also how they were identified, the testing scope, the methodology, and also mitigation suggestions. It's a common practice for an independent security testing firm to produce such documentation. The PCI DSS Penetration Test Guidance suggests a Penetration Test Report Outline as follows:

• Executive summary
• Statement of Scope
• Statement of methodology
• Segmentation test results
• Findings
• Tools used

Serpico is a penetration testing report generator, which can help to produce such a document. Although Serpico doesn't import the ...