Question

A penetration tester is finalizing the report for a mid-sized retail client. The document must serve two very different readers: the board of directors, who approved the engagement budget and want a high-level view of business risk, and the IT operations team, who must remediate each issue. Which approach best structures the report to meet both audiences' needs?

Accepted Answer

Include a concise executive summary focused on business risk and remediation priorities, followed by detailed technical findings with reproduction steps and evidence for the operations team.

Answer

Write a single technical narrative with full command output and CVSS vectors, since providing all raw data lets each reader extract what they need.

Answer

Deliver only the executive summary to the client and provide technical findings verbally during a debrief call to avoid exposing sensitive data in writing.

Answer

Send the board a spreadsheet of all raw scanner output and give the IT team a one-page bullet list of the most severe findings.