Pentest Reporting Maturity Grader

See where your reporting stands and what to fix first.

15 questions across 5 dimensions.
Your score in 3 minutes.

0 teams graded so far

Step 1 of 6

How big is your pentest team?

Step 2 of 6

Consistency

Whether your reports look and read the same regardless of who writes them.

Your reports follow a consistent template and format.

Never

Rarely

Sometimes

Usually

Always

Reports read like one author, regardless of who actually wrote them.

Never

Rarely

Sometimes

Usually

Always

Severity ratings stay consistent across different testers.

Never

Rarely

Sometimes

Usually

Always

Step 3 of 6

Knowledge Reuse

How much of each report draws on shared templates and past findings instead of starting from scratch.

You maintain a library of reusable finding descriptions.

Never

Rarely

Sometimes

Usually

Always

Your team copies from old reports when writing up similar findings.

Never

Rarely

Sometimes

Usually

Always

You have templates for common report sections (executive summary, methodology, etc.).

Never

Rarely

Sometimes

Usually

Always

Step 4 of 6

Methodology Discipline

Whether your team follows a defined testing process and captures evidence along the way.

Your team works through a defined methodology checklist during every assessment.

Never

Rarely

Sometimes

Usually

Always

Testers capture steps and evidence as they work, not after the fact.

Never

Rarely

Sometimes

Usually

Always

Every finding is verified before it is added to the report.

Never

Rarely

Sometimes

Usually

Always

Step 5 of 6

Collaboration & Review

Whether every report gets a second set of eyes before it ships.

Reports are peer-reviewed before they go out.

Never

Rarely

Sometimes

Usually

Always

You have a defined QA process for reports.

Never

Rarely

Sometimes

Usually

Always

Multiple testers can work on the same report at the same time.

Never

Rarely

Sometimes

Usually

Always

Step 6 of 6

Process Security

Whether drafts, evidence, and deliveries move through properly secured channels.

Drafts and evidence live in a secure, access-controlled system.

Never

Rarely

Sometimes

Usually

Always

You deliver reports through a secure channel.

Never

Rarely

Sometimes

Usually

Always

You keep an audit trail of who accessed or edited each report.

Never

Rarely

Sometimes

Usually

Always

Please answer all questions before continuing.

A Dradis project