What this prompt does
This prompt takes your unstructured raw findings — notes, tool output, scan results, whatever you captured during an engagement — and shapes them into a complete penetration test report that gives both a CISO and a remediation engineer what they need, with minimal editing required. The template enforces the full document structure that real auditors expect: executive summary calibrated for C-level readers, per-finding technical depth with CVSS v3.1 vector strings, and a prioritized remediation roadmap with three time horizons.
What makes it work is the deliberate layering of context variables. By feeding in [target_system], [scope], [test_type], and [report_standard] alongside the raw findings, you anchor the AI to your specific engagement rather than generating generic security advice. The instruction to produce both a non-technical and technical description per finding is the detail that actually saves you editing time — the AI separates the "what this means to the business" from "here is the exact attack vector," which is the split most report reviewers need.
The [methodology] variable is where this prompt goes from useful to genuinely professional. Whether you specify PTES, OWASP Testing Guide, or a custom scope, that label propagates into the Scope and Methodology section and gives auditors the traceability they look for during compliance reviews.
When to use it
- You have completed a black-box web application assessment and need a deliverable within 24 hours.
- Your raw notes are a mix of Burp Suite exports, Nmap XML, and personal observations that need normalizing into one document.
- A client requires a report aligned to a specific standard (ISO 27001 audit support, SOC 2 evidence, PCI DSS requirement 11.4).
- You are a solo consultant without a report template and need a professionally structured starting point fast.
- You are training junior testers and want to show them what a complete, section-by-section report looks like against real findings.
- You need to regenerate an updated report after a retest to reflect remediated versus still-open items.
Example output
## Executive Summary
During a five-day external network penetration test of api.example.com, three Critical
and two High severity vulnerabilities were identified that allow unauthenticated remote
code execution and full database read access. Left unaddressed, these expose customer
PII and payment records to exfiltration without any audit trail.
## Finding: Unauthenticated SQL Injection in /api/v2/orders
CVSS v3.1 Score: 9.8 (CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-89 | OWASP: A03:2021
Steps to Reproduce:
1. Send POST /api/v2/orders with body: {"id": "1' OR '1'='1"}
2. Response returns full orders table contents.
Remediation:
Use parameterized queries. Replace raw string concatenation in OrderController.php:
$stmt = $pdo->prepare("SELECT * FROM orders WHERE id = ?");
$stmt->execute([$id]);
Pro tips
- Feed real tool output into
[raw_findings]. Paste Nmap service detection lines, SQLMap confirmation output, or Nuclei template matches verbatim — the AI extracts structured findings more accurately from actual evidence than from paraphrased notes. - Set
[report_standard]precisely. "PTES" and "OWASP WSTG v4.2" produce meaningfully different methodology sections. If your client has a custom template requirement, name it here and add a note in the findings block. - Use
[test_type]to shape impact and reproducibility language. "black-box external" produces different scope assumptions than "grey-box internal with VPN credentials" — the AI applies this distinction throughout the report, not just in the methodology section. - Run findings through one AI pass, then edit CVSS vectors manually. CVSS v3.1 scoring requires judgment calls the AI sometimes gets wrong on Scope and Privileges Required. Treat the generated vector string as a starting draft, not a final score — use the NVD CVSS calculator to confirm before submitting to auditors.
- Pair with a second prompt for retest deltas. After remediation, re-run with
[raw_findings]containing only the retest observations and add "compare against previous findings" to the raw block — useful for generating a retest attestation letter.
