A penetration test report full of low-severity findings can look thorough and still fail to answer the question that matters: what could an attacker actually do here. The most useful engagements are judged by exploit paths and business impact, not by line count.
Findings are not the deliverable
A vulnerability scanner can produce a long list of issues in an afternoon. What it cannot do is chain them together the way a motivated attacker would — combining an information disclosure bug with a weak session control, or a minor authorization gap with a workflow quirk, to reach something that actually matters. That chaining work is where a human tester earns their scope.
Severity needs a rationale, not just a label
“Critical,” “high,” and “medium” only mean something when they’re backed by a clear explanation of exploitability and impact. A finding rated critical because a scanner’s default scoring said so gets deprioritized the moment an engineer disagrees with it. A finding rated critical with a documented exploit path and a plausible attacker motive gets fixed first.
What good scoping looks like
- Testing tied to how the product is actually used, not a generic checklist
- Explicit focus on authenticated flows, multi-step processes, and privilege boundaries
- Coordination with existing bug bounty or scanner data instead of duplicating it
- Retesting built into the engagement instead of treated as a separate favor
Retesting closes the loop
A test that ends at the report is only half done. The organizations that get the most value from penetration testing treat validation of fixes as part of the engagement, not an afterthought — because a fix that was never confirmed to work is functionally still an open finding.