The report
The final report of a pentest: automatic publication, content, frozen versions, PDF export, revocable share link, brand, and what it contains when no finding was proven.
Publication#
The report is published automatically at the end of the attempt, after the evidence, perimeter and consistency checks. No human validation takes place. A report is published even without any finding. You are notified in the application and, depending on your preferences, by e-mail.
Content#
| Part | Content |
|---|---|
| Executive summary | The verdict ("Action required" or "No proven exposure"), the number of proven findings, of evidence items and of paths. |
| Perimeter and conditions | The exact authorised target, the Guidance used, the finalisation date, the attempt presented. |
| Findings | Each finding with severity, CWE, description, impact, recommendation and evidence. |
| Attack paths | The proven chains and their provenance. |
| Coverage | The surfaces tested. |
| NIS2 index | The evidence classified according to selected controls (see NIS2 index). |
| Limits | What the test does not cover, written in the report itself. |
A frozen document#
Each report is a snapshot: data, brand and limits are frozen at publication. The exports re-read that same snapshot, never the raw execution artefacts. A published report does not change; a new pentest produces a new report. The Reports page shows the latest published report, then the history.
Export as PDF#
From the report, download the PDF. It carries the same content as the online version, under the brand of the client space (SpectrAI or your partner's).
Share through a link#
- From the report, choose Share.
- Choose the duration of the link, then create it.
- Copy the link and pass it on.
The link opens this version of the report in read-only mode, without an account. It expires on the chosen date and can be revoked at any time; you can then create a new one. Shared report pages are not indexed by search engines.
Brand#
For a client of a white-label partner, the report carries the partner's name and logo. See White label.
Report without any finding#
A report without any finding attests that no weakness was proven within the scope and during the test. It does not prove the absence of weakness. Without a finding there is nothing to retest; for an internal scan, the additional URLs offered within the sixty-day window remain possible.