On this page
Why ask for a sample VAPT report first
The report is what you actually buy. Testing happens out of sight, but the document is what your engineers work from, what your auditor files and what your customer’s security team reads. Asking for a sample is the fastest way to tell an expert-led test from a scanner export with a logo on it.
Read the sample the way your three audiences will: leadership wants risk in one page, engineering wants steps to reproduce and fix, and the auditor wants scope, dates, method and proof of closure.
The sections of a VAPT report, in order
- Cover and scope. Who the report was prepared for, which applications, APIs or networks were tested, the test window and the version of the report. Auditors check this first, because a finding only counts against something that was in scope.
- Executive summary. An overall risk rating, a count of findings by severity and a short narrative of what an attacker could do. In the Sumrite sample this is a single page with a risk gauge and severity bars that a board member can read in a minute.
- Methodology and standards. How the test was run: grey box or black box, the roles and tenants used, and the standards followed, such as OWASP WSTG, the OWASP API Security Top 10, MASVS for mobile and CVSS for scoring.
- Findings. One entry per issue: title, severity, affected asset, a description, the request and response or screenshot that proves it, the business impact and specific remediation for your stack.
- Remediation tracker. Every finding with an ID, severity, owner and status, so your team can close them one by one. This is the page engineering lives in after the readout.
- Retest and closure. After fixes, each finding is tested again and marked fixed or still open. The closed report or retest letter is what most customers and auditors ask for.
What good looks like in each section
- Executive summary
- Plain language, a clear overall rating and the two or three issues that matter for the business. No tool names, no jargon.
- Severity
- Rated on real impact, not a raw scanner score. A missing header is low; another customer's invoices are critical.
- Evidence
- The exact request, response or screenshot that proves the finding. Your engineers should be able to reproduce it without calling the tester.
- Remediation
- Specific to your framework and code, not a link to a generic standards page.
- Retest
- Each finding shown as fixed or open after your changes, with the retest date.
Red flags in a sample report
- Most findings are missing security headers, version disclosure or cookie flags
- Findings have no request, response or screenshot behind them
- Remediation text is the same generic paragraph for every issue
- No mention of which user roles or tenants were tested
- No retest section, or a retest that costs extra and is optional
- Scope and test dates are missing, so an auditor cannot rely on it
If you see these, read what makes a VAPT report worth paying for and the difference between a VAPT and a vulnerability scan.
How the report maps to compliance
One well-scoped report can serve several reviews. SOC 2 auditors look for an independent test, findings and evidence of remediation; ISO 27001 auditors map it to technical vulnerability management; PCI DSS asks for internal and external testing with retesting of fixes. Our guides to the SOC 2 VAPT report, ISO 27001 VAPT and PCI DSS penetration testing explain what each one checks.
For what happens before the report is written, see what a VAPT comprises, from scoping through to retest.
See the Sumrite sample report
Watch the walkthrough and read the sample on the sample VAPT report page, or get a quote and we will send the redacted full-length sample with it.
Frequently asked questions
What does a sample VAPT report contain?
A cover page with scope and test dates, an executive summary with an overall risk rating and a count of findings by severity, a methodology section, each finding with evidence, impact and remediation steps, a remediation tracker, and a retest section showing which findings are now closed.
Where can I see a sample VAPT report?
Sumrite publishes a sample VAPT report at sumrite.com/resources/sample-vapt-report, including a short video walkthrough. A redacted full-length sample is sent on request.
What is the executive summary in a VAPT report for?
It is the one page leadership, procurement and auditors read. It gives the overall risk in plain language, the number of critical, high, medium and low findings, and what has to be fixed before the report is shared with a customer or auditor.
How are findings rated in a VAPT report?
Each finding gets a severity of critical, high, medium or low, usually based on a CVSS score adjusted for real business impact: what data or function an attacker reaches and how hard the attack is to carry out.
Does a VAPT report include a retest?
A good one does. After your team fixes the findings, the tester verifies each fix and the final report or retest letter marks findings as closed. Auditors and enterprise buyers usually ask for this evidence.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
