Sample pentest report: what the deliverable looks like, with fictional data
A real report structure, with an invented company, systems and findings
Pentesting
Sample pentest report: what the deliverable looks like, with fictional data
An illustrative, fictional penetration test report: executive summary, scope, methodology, six findings with CVSS v3.1 scores and vectors, a prioritised remediation plan and a reading guide. The company, systems and dates are invented; it does not describe any real client or system.
Contents / Contenido
- 1. Executive summaryPreview
- 2. Scope and rules of engagementPreview
- 3. MethodologyRequires download
- 4. Findings summaryRequires download
- 5. Findings in detail (examples)Requires download
- 6. Prioritised remediation planRequires download
- 7. Conclusion and next stepsRequires download
- AppendicesRequires download
Preview: first pages
An illustrative, fictional penetration test report: executive summary, scope, methodology, six findings with CVSS v3.1 scores and vectors, a prioritised remediation plan and a reading guide. The company, systems and dates are invented; it does not describe any real client or system.
The preview of this whitepaper includes the executive summary, regulatory context and methodological approach that frames the rest of the document. Download to access full templates, matrices and checklists.
- 1. Executive summary
- 2. Scope and rules of engagement
Gorka Gonzalo
Founder & CEO
Founded Hodeitek in 2023 and runs the company, after more than 8 years in pentesting, Red Team, OT/ICS auditing, and SOC leadership. A cybersecurity and AI expert, he sets the technical and product direction of HodeiShield and personally leads the most critical engagements — from defense strategy to applying AI in threat detection. He is the client's direct point of contact: whoever scopes the work also answers for the result.
Related resources
Guide: reducing alert fatigue in a security team
A five-step method to give a security team its hours back: a baseline before changing anything, an owner for every rule, noise reduction at the source, correlation and context-based prioritisation. It explains where AI helps and where it does not, and closes with an improvement loop and a checklist. It includes no savings figures: every improvement is measured in your own environment.
OT cybersecurity for plant management: a 25-question self-assessment and a 12-month roadmap
A guide for whoever is accountable for keeping the line running: plant management, maintenance and process engineering. It includes a 25-question self-assessment in five blocks (inventory, network and segmentation, access, detection and response, recovery and suppliers), a 12-month roadmap ordered by risk of downtime, a short explanation of what IEC 62443 and NIS2 ask for, and the facts on the SPRI Industrial Cybersecurity 2026 grant, subject to the rules of the call. October 2026 edition, version 1.0.
DORA: Compliance Manual for Financial Entities
Regulation (EU) 2022/2554 (DORA) has applied directly across the EU since 17 January 2025 and governs how financial entities must manage ICT risk, classify and notify incidents, test their resilience (including TLPT) and manage their technology providers. This manual translates DORA's five pillars into a step-by-step implementation plan, with an exhaustive checklist per pillar and a reusable ICT provider factsheet template.