Safe pentest disclosure
How to share penetration-test results with a customer safely
Who this guide is for
SaaS security owners, CTOs, founders, sales engineers, legal teams, and customer-assurance teams responding to penetration-test evidence requests.
Key takeaways
- Verify the recipient and decision before selecting an artifact.
- Lead with a customer-safe executive summary.
- Separate open-risk status from exploitable technical detail.
- Use access controls, expiry, and disclosure records.
- Never edit the tester's conclusions in a misleading way.
Clarify what the customer must approve
Ask whether the reviewer needs confirmation that testing occurred, the engagement scope, independence, methodology, material findings, remediation status, or the complete technical report. Many reviews can be satisfied without distributing every exploit path and affected component.
Prepare a customer-safe summary
Include the testing organization, engagement dates, authorized systems, broad methodology, important exclusions, severity model, count or status of material findings, remediation status, retest status, and report date. Preserve the original conclusions and state when the summary was prepared by your company rather than the tester.
Review the full report for disclosure risk
Full reports can contain hostnames, paths, screenshots, user information, technology versions, payloads, credentials, chained attack detail, internal architecture, and weaknesses outside the customer's legitimate need. The report owner, security team, and legal or commercial owner should decide whether disclosure is appropriate.
Control access and downstream use
Use a named-recipient portal or expiring controlled link where appropriate. Apply the governing NDA or disclosure terms, disable unnecessary resharing, watermark if your policy requires it, and maintain a log of the artifact version, recipient, approver, date, and expiry.
Explain open findings accurately
State whether material findings are open, mitigated, accepted, or retested. Do not delete unresolved findings from a summary to create a false impression. When detail cannot be shared, explain the current status and offer a controlled discussion with the responsible technical owner.
Close the disclosure lifecycle
Revoke expired access, retain the disclosure record, capture follow-up questions, and update the customer-safe summary after material remediation or a new test. Retire old summaries so sales cannot accidentally present them as current.
Choose the right disclosure level
| Customer need | Recommended starting artifact | Escalate when |
|---|---|---|
| Confirm a relevant test occurred | Attestation or customer-safe executive summary | Scope, date, or provider does not satisfy the requirement |
| Understand material risk and remediation | Executive summary plus remediation and retest status | The buyer needs evidence for a specific unresolved finding |
| Perform detailed technical diligence | Controlled report review or approved redacted report | Full technical detail or copies are requested |
| Meet a contractual audit right | Artifact defined by the contract and approved process | The request exceeds the contract or creates disclosure risk |
| Request is broad or unexplained | Ask for the decision, scope, recipient, and retention requirement | The requester cannot establish a legitimate need |
Customer disclosure cover note
Attach this context to the approved artifact
This [executive summary / redacted report] relates to the penetration test performed by [provider] from [start date] to [end date] against [authorized scope]. It is being shared to support [customer review purpose].
The engagement excluded [material exclusions]. As of [status date], [material finding and remediation status]. [Retesting status]. The document does not assess systems or controls outside the stated scope.
This artifact is classified [classification] and is provided to [named recipient/team] through [controlled channel] under [applicable confidentiality terms]. Please do not redistribute it. Direct questions or requests for additional evidence to [security contact].Recommended workflow
- Confirm the requester and approval need.
- Choose the least-sensitive sufficient artifact.
- Review scope, redactions, and accuracy.
- Approve and share through a controlled channel.
- Log disclosure, expiry, follow-up, and revocation.
Use the worksheet
Turn the guide into an owned process.
Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.
Open printable checklistFrequently asked questions
Should we send the full pentest report?
Not by default. Begin with the least-sensitive artifact that satisfies the review, then escalate through the approved disclosure process if detailed evidence is necessary.
Can we remove open findings from the customer summary?
Do not create a misleading account. Summarize material status accurately and explain remediation, risk treatment, or retest status at an appropriate disclosure level.
Does an NDA make full-report sharing automatically safe?
No. An NDA is one control; you still need a legitimate purpose, verified recipient, internal approval, appropriate access controls, and a review of the report's sensitive contents.
Sources and further reading
- NIST SP 800-115: Technical Guide to Information Security Testing
- NIST SP 800-30: Guide for Conducting Risk Assessments
This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.