# How to judge a pentest provider by its sample report Source: https://pentestcompare.com/guides/judge-a-pentest-provider-by-its-sample-report/ Publisher: Excession Labs (pentestcompare.com) Last updated: 2026-11-09 Nine signals to check in a pentest sample report before you buy, plus which of 14 providers publish one, with links and the date we checked them. > **Short answer:** A sample report shows how a provider works before you sign. Check nine things: scope statement, method, evidence for each finding, reproduction steps, controls, severity definitions, remediation advice, retest results and stated limits. As of November 2026, 4 of the 14 providers in our dataset publish a sample, 2 give one on request and 8 publish none. Excession Labs, the publisher, adds a fifth public sample. A pentest sample report shows a provider's work before you pay for it. You can read what the tester proved, how they proved it and what they admit they did not test. The table below shows which providers publish a sample. Nine signals follow for judging one. ## Which pentest providers publish a sample report? As of November 2026, four of the 14 providers in our dataset publish a sample report, two give one on request, and eight publish none. Excession Labs, the publisher of PentestCompare, also publishes one. We took each link from the provider's own pages on 9 November 2026. We did not grade the samples, and some links come from page text without a full read of the file. | Provider | Sample report | Where | |---|---|---| | [Aikido](/providers/aikido/) | Public | Downloads on the [AI pentest page](https://www.aikido.dev/attack/aipentest) | | [Excession Labs](/providers/excession-labs/) | Public, labeled demonstration (see note below) | [Sample report](https://penetrationtestservices.com/sample-report/) | | [Parameter](/providers/parameter/) | Public | [PDF](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) | | [Secure Ideas](/providers/secure-ideas/) | Public | [Sample report](https://secureideas.com/sample-report) | | [TurboPentest](/providers/turbopentest/) | Public | [Sample report](https://turbopentest.com/sample-report) | | [BreachLock](/providers/breachlock/) | On request | Ask the provider | | [Cobalt](/providers/cobalt/) | On request | Ask the provider | | [Escape](/providers/escape/), [Hadrian](/providers/hadrian/), [HackerOne](/providers/hackerone/), [Horizon3.ai](/providers/horizon3/), [Pen Test Partners](/providers/pen-test-partners/), [Synack](/providers/synack/), [Terra Security](/providers/terra-security/), [XBOW](/providers/xbow/) | Not published | None found on the pages we checked | The Excession Labs sample report is a labeled demonstration built on a made-up app, not a customer engagement. ## What are the nine signals of a good pentest report? A good report lets a stranger repeat each finding and decide what to fix first. You can check all nine signals by reading, with no tools. Each maps to a section most reports have, though no standard fixes the layout. The PCI SSC guidance says its report outlines "are only suggested outlines and do not define specific reporting requirements" for PCI DSS pentests. ### 1. Does the scope statement name exact assets? The scope statement should list hosts, URLs, API base paths, roles and accounts, plus the test window and what was excluded. "The web application" is not a scope. If the report cannot say what was in scope, you cannot say what was left untested. ### 2. Does it describe the method? Look for the approach (black box, grey box or white box), the guides used (for example OWASP's Web Security Testing Guide) and a split between manual work and tooling. A method section that only names a scanner tells you the report is scanner output. ### 3. Does each finding carry evidence? Evidence means the request, the response and what changed. A write is proven when another session reads the changed record back. A bare "200 OK" is not proof. Screenshots without URLs, timestamps or account names are weak. ### 4. Can you reproduce each finding? Reproduction steps should list the preconditions, the accounts, the exact requests and the expected result. Ask your engineer to follow one finding with no help from the provider. If they stall, the steps are incomplete. ### 5. Does it show controls? A control is a test that should fail: a nonexistent ID, another account's token, an anonymous call. A report that lists "controls that held" shows what the tester checked and found sound. It also tells your team which protections a fix must not break. ### 6. Are severity levels defined? The report should say what Critical, High, Medium and Low mean in plain words, or give a CVSS vector and say which version. FIRST states that CVSS v4.0 qualitative ratings are None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0, and that use of them is optional. A severity with no definition cannot be argued with or ranked. ### 7. Is the remediation advice specific? "Validate input" is generic. "Check that the invoice's account ID equals the session's account ID on the server before returning it" is a fix. Good advice names the layer, the check and a way to confirm the fix. ### 8. Does it show retest results? Look for a retest section or a retest sample. PCI DSS v4.0.x requirement 11.4.4 says exploitable findings are corrected and the testing is repeated to verify the corrections. A retest section lists the original finding, the retest date and the result. Terms differ between providers: HackerOne's docs describe unlimited retests inside a remediation period of typically 30 or 90 days, and TurboPentest's pricing page describes a retest as a new pentest at the same per-target price. See each [profile](/providers/) for the exact claim and source. ### 9. Does it state its limits? A section on limitations and open questions lists what the tester could not reach, what was inferred and what stays unconfirmed. Reports with no limits section imply complete coverage, which no test has. ## How do you score a sample report? Score each signal from 0 to 2: 0 when it is missing, 1 when it is partial, 2 when you could act on it. Add the scores for a total out of 18. The score is a reading aid and no standard defines it. Compare providers on the same sample type: a report for a web app, a report for an API and a report from an automated run are not the same product. > **Scoring sheet:** | Signal | 0 | 1 | 2 | > |---|---|---|---| > | Scope statement | Generic | Assets only | Assets, roles, window, exclusions | > | Method | Tool name only | Approach named | Approach, guides, manual versus tooling | > | Evidence per finding | Screenshots only | Request or response | Request, response and effect shown | > | Reproduction | Absent | Prose steps | Exact requests and expected result | > | Controls | Absent | Mentioned | Listed with outcomes | > | Severity definitions | Labels only | Labels and CVSS | Written scale or stated CVSS version | > | Remediation | Generic | Specific to the class | Specific to the app, with a check | > | Retest | Absent | Offered | Shown in the report | > | Limitations | Absent | A disclaimer | Specific untested areas | ## What a sample report cannot tell you A sample cannot show who will test your system, how long it will take or what the report will say about your app. It shows the provider's best format. A demonstration report built on a made-up app, such as Excession Labs', shows the layout and the evidence style and nothing about a real engagement. Match the sample to your case. A report for a network test says little about an API test. An automated run's report can look complete and still skip business-logic checks. Ask for a redacted report of similar scope, and use the [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) to follow up on gaps. To compare prices next to these signals, read the [pentest cost guide](/guides/penetration-testing-cost/). PCI SSC's guidance also says that qualifications "cannot be met by certifications alone", so read the sample for evidence of engagement experience as well as for badges on the provider's website. The [PCI penetration testing guide](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/) on our publisher's service site covers the standard's text. ## Questions ### Can a sample report be faked or polished? Yes. A sample is chosen by the provider, and it may be rewritten for public view. Treat it as the best case. Ask for a redacted report from a real engagement of similar scope and compare the two. If the real report is thinner than the sample, you have learned something. ### Does the length of a report show quality? No. A long report can be mostly scanner output. Count the findings that have a request, a response and a result you could repeat. A short report with strong evidence for each finding is easier to act on than a long one with none. ### What if the provider will not share any sample? Eight of the 14 providers we checked publish no sample, so this is common. Ask for a redacted report under NDA. If that is refused too, ask for a call where the provider walks through one finding from request to fix. ### Which severity scale should a report use? No standard forces one scale. FIRST's CVSS v4.0 bands are None, Low, Medium, High and Critical, and use of the ratings is optional. A written scale with a definition for each level also works. Pick the scale your customers and auditors ask for during scoping. ## Sources - [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf) - [FIRST CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) - [PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0 (11.4.1 and 11.4.4)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf) - [HackerOne docs: retesting pentests](https://docs.hackerone.com/en/articles/8541386-retesting-pentests) - [Parameter sample pentest report (PDF)](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) - [Aikido AI pentest page (sample downloads)](https://www.aikido.dev/attack/aipentest) - [TurboPentest sample report](https://turbopentest.com/sample-report) - [Secure Ideas sample report](https://secureideas.com/sample-report) - [Excession Labs sample report (labeled demonstration)](https://penetrationtestservices.com/sample-report/)