# PENETRATION TEST EXECUTIVE REPORT

---

| Field | Value |
|-------|-------|
| **Engagement Reference** | [REF-NUMBER] |
| **Client** | [CLIENT NAME] |
| **Report Date** | [DATE] |
| **Classification** | STRICTLY CONFIDENTIAL |
| **Distribution** | [List authorized recipients] |

---

## EXECUTIVE SUMMARY

### Overall Risk Rating: 🔴 CRITICAL

[2-3 paragraph non-technical summary of findings and business risk]

### Key Findings

| Severity | Count | Business Impact |
|----------|-------|-----------------|
| 🔴 Critical | X | Immediate threat to business operations |
| 🟠 High | X | Significant risk requiring priority attention |
| 🟡 Medium | X | Moderate risk to be addressed within 30 days |
| 🔵 Low | X | Minor issues for scheduled remediation |

### Critical Business Risks Identified

1. **[Risk 1]**: [Plain language description of highest risk]
2. **[Risk 2]**: [Second highest risk]
3. **[Risk 3]**: [Third highest risk]

---

## ATTACK NARRATIVE

*The following describes how an attacker with no prior access could compromise [CLIENT]'s systems:*

[Tell the attack story in plain language — no technical jargon]

An attacker beginning with only publicly available information would first [Phase 1 description]...

This initial access would then enable [Phase 2 description]...

Ultimately, an attacker could [impact description — what they could do with full access]...

---

## PRIORITIZED REMEDIATION ROADMAP

| Priority | Finding | Risk | Timeline | Owner |
|----------|---------|------|----------|-------|
| 1 | [Critical finding] | Business disruption | 24 hours | Security/IT |
| 2 | [High finding] | Data breach risk | 7 days | Development |
| 3 | [High finding] | Compliance violation | 30 days | IT/Security |

---

## CONCLUSION

[2-3 paragraphs on overall security posture, positive findings, and path forward]
