@TechEmiiily Pictures & recommendations, you welcome ;) Also an attack narrative section is usually pretty chunky.

@pry0cc That’s my chunkiest section so ayeeeee

@TechEmiiily 20 pages of text? Or 20 pages including tables, graphics, screenshots, tool output, and vulnerability information?

@AccidentalCISO 20 pages in general between all of what you stated is the average of samples I see

@TechEmiiily If your company have a minimum length for reports, that's ridiculous. Report the issues, recommendations, add the executive summary, graphs, appendices if you need them, and be done with it. Who do they think the extraneous content is going to help?

@0xTib3rius My company doesn’t have a minimum limit I’m just seeing averages from samples and they’re all 20-50 pages minimum 😭

@TechEmiiily I write 70+ page reports quarterly where do I sign up? *cracks knuckles*

@CyberSnark How do I spin off of a bunch of fluff for a physical test that isn’t too repetitive from a cyber test? They already submitted the cyber test so now I’m reading it over like “sheesh I feel like I’m repeating myself”

@TechEmiiily APA formatting helps 🤣

@drb0n3z I’ve smoked away that part of my memory banks, back to Google!

@TechEmiiily 20 pages?! I think I've only had one that short in my career. 😄

@CurtBraz Wait are you the author from M is for Malware?!

@TechEmiiily *Me who just presented an 85 page purple team report...

@Kurt_theTurk Heck yea go you! That’s badass!

@TechEmiiily Every pentest report I have ever seen is at least a page per item that was in scope for the test. Screenshots, narrative, recommendation is the formula given.

@TechEmiiily Bullet lists. Comic Sans.

@TechEmiiily My reports are between 40 and 60 pages. There’s also a very short PowerPoint presentation that summarizes the findings.

@TechEmiiily You know what most pentest companies miss in their reports which is super valuable(well, to an org like ours, maybe not everyone), what you tested and *didn’t* find anything wrong with. ‘Great, you popped a DC, did you fail to pop the other 9 or didn’t have time to try them?’

@cricket_hippo This was a physical test so I don’t even have the luxury of putting fluff like that in there. 😭