[ client environment ]
Point-in-time security assessment findings and remediation guidance.
Overall risk: High - Composite 72/100This is a sample of the report PentestOps produces. It shows the structure, the severity model, the evidence format, the compliance mapping and the remediation plan. Every client name, hostname, address and identifier has been removed. A real report is confidential to the client and is never published.
This assessment identified 34 findings, of which 2 were confirmed exploitable with proof. Overall risk is rated High. The composite score blends finding severity with confirmed exploitability, so one proven attack path weighs more heavily than a larger number of unvalidated detections.
| Key outcome | Result |
|---|---|
| Total findings | 34 |
| Confirmed exploitable (proof captured) | 2 |
| Detected, not exploited | 32 |
| Critical / High | 2 / 6 |
The assessment found a reachable path from the public internet to customer order data. An exposed staging application accepted a default credential pair, and the session it issued was accepted by the production API because both environments sign sessions with the same key. That is the finding that matters: the individual weaknesses are ordinary, but chained they cross a trust boundary the business assumes is closed.
The remaining findings are largely hygiene: unpatched components on the edge proxy, an administrative interface reachable from the public internet, and directory listings exposing build artefacts. None were individually exploitable during the window, but several shorten the path for an attacker who gains an initial foothold.
The chain below was executed under the agreed Rules of Engagement, with each step recorded. It is shown because a demonstrated path is more useful to a remediation owner than a list of severities.
| Step | Action | Result |
|---|---|---|
| 1 | Enumerated hosts under the in-scope domain | One unadvertised staging application found |
| 2 | Tested the staging login for default credentials | Accepted a documented vendor default |
| 3 | Inspected the issued session token | Signed with a key shared across environments |
| 4 | Replayed the token against the production API | Accepted; order records returned |
| 5 | Stopped and recorded evidence | No data exported, per Rules of Engagement |
The staging application accepted a vendor default credential pair. The account held sufficient privilege to issue a session token trusted beyond the staging environment.
A token issued by the staging environment was accepted by the production API, because both environments sign and validate sessions with the same key and neither records which environment issued the token.
The reverse proxy advertises a release superseded by several security updates. Not exploited during the window, but it is the most exposed component in scope and should be patched first among the unvalidated findings.
A management console intended for internal use answers from any source address. The login itself resisted the credentials tested, so this is reported as exposure rather than as a confirmed compromise, but it should not be reachable at all.
Directory listing exposes build output including source maps, which reveal application structure and occasionally embedded configuration.
Five findings are shown above. The remaining 29, across High, Medium, Low and Informational severity, appear in a real report with the same evidence, business impact and remediation structure.
Findings are mapped to the frameworks the organisation reports against. The mapping shows where a finding sits against a control. It is not a statement that the organisation is certified, and it does not replace an assessor.
| Finding | OWASP Top 10 | ISO 27001 | PCI DSS v4.0 |
|---|---|---|---|
| Default credentials accepted | A07 Identification and Authentication Failures | A.5.17 | 8.3.1 |
| Cross-environment token acceptance | A01 Broken Access Control | A.8.3 | 7.2.1 |
| Outdated edge proxy | A06 Vulnerable and Outdated Components | A.8.8 | 6.3.3 |
| Admin interface publicly reachable | A05 Security Misconfiguration | A.8.20 | 1.3.1 |
| Directory listing enabled | A05 Security Misconfiguration | A.8.9 | 6.4.1 |
| Priority | Action | Owner | Verification |
|---|---|---|---|
| P0 | Remove default credentials, rotate exposed secrets | Application | Re-test login, confirm rejection |
| P0 | Give each environment its own session-signing key | Identity | Replay test returns 401 |
| P1 | Patch edge proxy to current release | Platform | Re-scan confirms version |
| P1 | Restrict admin interface to a management network | Network | External request times out |
| P2 | Disable directory listing, purge build artefacts | Web | Path returns 403 |
Each item can be re-verified on demand rather than waiting for the next scheduled assessment, so a fix can be evidenced the day it ships.
This is a sample document published to show report structure and output. It does not describe any real environment. All client names, hostnames, addresses, identifiers and evidence values have been removed.
In a real engagement, testing is performed under an agreed Rules of Engagement against the authorised scope only, and no out-of-scope system is targeted. An assessment is point-in-time: findings reflect the environment during the testing window and do not guarantee the absence of other vulnerabilities. Severity is based on CVSS enriched with exploitability signals. Findings marked "Confirmed exploitable" were reproduced with proof; findings marked "Detected" were observed but not exploited. A real report is confidential to the client and is never published.