# Results

> What a completed pentest produces: findings with their evidence, attack paths, a frozen report, two correction retest batches and a NIS2 evidence index.

A completed pentest publishes its results automatically: the demonstrated findings and their evidence, the derived attack paths, then the final report, frozen and exportable. Two correction retest batches are included within sixty days. The NIS2 index organises the evidence according to selected controls, without claiming to be an attestation.

> [!NOTE]
> What has not been demonstrated is not published. A report without any finding is a normal report: it attests that no weakness was proven within the perimeter and the time of the test, not that the application is secure.

---

https://docs.spectr-ai.eu/en/resultats