Seven Criteria That Separate a Good Report from an Insurer-Ready Report
A penetration test is only as valuable as the report it produces. For organizations using their cyber insurance to cover testing costs, the report needs to satisfy the carrier's risk management team. For organizations using the test to reduce their premium at renewal, the report needs to demonstrate meaningful security improvement. For both, the report must meet specific standards.
After years of producing reports for insured engagements, we know exactly what carriers want to see. Here are the seven criteria that make the difference between a report that gets filed away and a report that gets you reimbursed, reduces your premium and protects your claims position.
1. Scope Definition
The first thing a carrier's risk management team checks is what was actually tested. A clear scope definition includes the IP ranges, domains, applications and network segments that were in scope. It also includes what was explicitly excluded and why.
Scope matters because it tells the insurer the extent of the assessment. A test that covered external infrastructure only is different from one that covered external and internal networks, web applications and cloud environments. The broader the scope, the more confidence the carrier has in the results.
A weak scope definition creates questions. If the report says "external penetration test" without listing specific targets, the carrier cannot determine whether critical assets were included. Our reports include detailed scope documentation with asset counts, testing boundaries and exclusion rationale.
2. Methodology
Carriers want to know that the test followed a recognized methodology. References to industry frameworks like OWASP Testing Guide, NIST SP 800-115, PTES (Penetration Testing Execution Standard) or OSSTMM signal that the tester followed a structured approach rather than running automated scanners and calling it a pentest.
The methodology section should describe the phases of testing: reconnaissance, enumeration, vulnerability identification, exploitation and post-exploitation. It should also note any limitations encountered during testing, such as time constraints, access restrictions or defensive controls that affected the testing process.
3. CVSS Ratings
Every finding in the report should include a CVSS (Common Vulnerability Scoring System) rating. CVSS provides a standardized 0-10 severity scale that insurers use to compare findings across organizations and across time. Without CVSS ratings, the insurer has no consistent framework for understanding the severity of what was found.
Carriers pay particular attention to the distribution of findings across severity levels. A report with zero critical findings and three medium findings tells a very different story than a report with five critical findings. They also compare findings year over year. If last year's report had eight critical findings and this year's has two, the improvement is clear and quantifiable.
4. Remediation Steps
Identifying vulnerabilities without providing remediation guidance is incomplete. Carriers want to see specific, actionable remediation steps for each finding. Generic advice like "apply patches" or "improve security configuration" is insufficient. Each finding should include a clear remediation path with enough detail for the IT team to implement the fix.
Strong remediation steps include the specific patch or configuration change required, the systems affected, the estimated effort to remediate and the expected risk reduction. This level of detail shows the insurer that the test was conducted by someone who understands not just how to find vulnerabilities but how to fix them.
5. Executive Summary
The executive summary is the section that carrier risk managers actually read. It needs to be written for a non-technical audience and should cover the overall risk posture in plain language, not just a list of vulnerabilities. A strong executive summary includes:
- The scope and objectives of the test
- A high-level summary of the most significant findings
- The overall risk rating and what it means for the organization
- Key recommendations prioritized by business impact
- Comparison to previous tests if applicable
The executive summary is also what your broker presents to underwriters at renewal. A well-written executive summary can directly influence your premium. If the summary clearly communicates that the organization tested proactively, found manageable issues and remediated them promptly, the underwriter has reason to reduce the rate.
6. Tester Credentials
Carriers want to know who conducted the test and whether they are qualified. The report should include the tester's name, professional certifications (CISSP, OSCP, CREST, etc.), years of experience and any relevant specializations. This is not vanity. It is a qualification check that affects the credibility of the findings.
A pentest conducted by someone with no recognized certifications carries less weight with a carrier than one conducted by a CISSP-certified examiner with 20 years of experience. Our team's credentials satisfy every carrier's qualification requirements.
7. Retest Results
The strongest pentest reports include retest results that verify remediation. After the initial test identifies vulnerabilities and the organization remediates them, a retest confirms that the fixes are effective. This closes the loop and tells the insurer that the organization did not just identify problems but actually fixed them.
Retest results transform a pentest from a one-time assessment into evidence of a continuous improvement process. Carriers reward this approach because it demonstrates that the organization treats security as ongoing work, not a checkbox exercise.
Our Reports Check Every Box
Every penetration test report from Sherlock Forensics includes all seven elements. We built our reporting template specifically for insured engagements because we understand that the report serves multiple purposes. It is a technical document for your IT team, a reimbursement document for your carrier, a claims-file document for future protection and a renewal document for premium reduction.
If your current pentest vendor does not provide all seven of these elements, you are leaving value on the table. Contact us about an insurer-ready penetration test that your policy may already cover.