See What a CredShields Pentest Report Looks Like
See exactly what your team will receive.
A sanitized version of an actual CredShields pentest report. Real findings, real reproduction steps, real remediation guidance. So your team and your auditor know what to expect before you sign.
A real report from a real engagement.
Most vendors send a glossy PDF that looks like a sales deck. Our sample is the actual deliverable from a real client engagement (sanitized for confidentiality). Same structure, same depth, same evidence quality your team and your auditor will receive.
- Executive summary written for non-technical readers
- Detailed findings with severity, CVSS 3.1, reproduction
- OWASP ASVS L2/L3 coverage matrix per finding
- Remediation guidance with code examples
EXECUTIVE SUMMARY · 4 critical, 7 high, 12 medium, 18 low · 87% of OWASP ASVS L2 verified · 6 business logic flaws identified · All findings reproduced w/ working PoC FINDINGS BY CATEGORY Authentication 3 high, 2 medium Multi-tenant isolation 1 critical, 2 high Injection 0 (clean) Business logic 2 critical, 1 high Cryptography 2 medium, 3 low Session management 1 medium REMEDIATION TIMELINE Critical fix < 7 days High fix < 30 days Medium fix < 90 days → Continued for 28 pages with full PoCs
Report Sections
Every section, explained.
One-page overview for stakeholders. Risk rating, critical findings, remediation roadmap. Written for board members and C-suite, not security engineers.
How we tested. NIST SP 800-115, OWASP ASVS, PTES alignment. Tools used. Scope boundaries. Auditors reference this directly.
Every finding with severity, CVSS 3.1 score, OWASP category, MITRE ATT&CK technique, reproduction steps, impact assessment, remediation guidance, and CWE reference.
A walkthrough of one full PoC: cURL commands, request/response headers, expected vs observed behavior. Your engineers can replay it independently.
OWASP ASVS L2/L3 verification map showing pass / fail / not applicable for every requirement tested. Drops directly into your audit binder.
Severity-prioritized fix order with effort estimates and risk-of-deferral notes. Includes architectural recommendations beyond per-finding fixes.
Frequently Asked