Questions to Ask Your Pentester to Understand Your Findings

Penetration tests constitute a crucial and indispensable component of an organization’s risk management strategy. The true value of these assessments lies not solely in identifying vulnerabilities, but in reviewing them holistically, deeply understanding their implications, and judiciously prioritizing actions. The results from a pentest should act as a catalyst to drive the organization's overarching risk mitigation strategy. 

Once a pentest concludes, your pentesters will share a summary of the results and a list of vulnerabilities with appropriate risk ratings. Each reported vulnerability may have a different risk rating, typically corresponding with the Common Vulnerability Scoring System (CVSS) Base scoring system, ranging from "critical" to “none.” The higher the CVSS score, the more critical the vulnerability, and the more urgently it needs to be fixed. 

Understanding Context and Impact

Knowing about a vulnerability's existence is not sufficient. You need to understand how it impacts your specific environment. For example, a vulnerability related to broken access control may lead to catastrophic consequences in one setting—while in another, it may be an intentional design element. 

The following questions help frame the business risk, rather than merely focusing on a vulnerability’s technical severity.

• What is the true impact if this vulnerability is exploited in our environment? 
• Could successful exploitation lead to the compromise of sensitive data, crown jewels, or critical operations? 
• Is this a standalone finding, or could it be chained with other findings to enable a more disastrous compromise? 
• Which category of attacker (internal, external, authenticated, or unauthenticated) may exploit this vulnerability?

Identifying Systemic Issues

Not all vulnerabilities are created equal. Many are telltale signs of deeper systemic issues. By recognizing these patterns, you can address the root causes instead of just treating individual symptoms. This proactive approach not only resolves problems but also strengthens the organization’s cybersecurity posture for the long haul.

Ask these questions to understand root causes of vulnerabilities. 

• Do these findings indicate underlying weaknesses in security practices, such as insufficient change management, or employees using weak passwords? 
• Are there any recurring vulnerabilities appearing from previous tests? 

Collaboration and Communication

Collaboration with your pentesters is vital for achieving the best results from a penetration test. This ensures that everyone is aligned and that all findings are clearly understood, leading to a well-thought-out remediation plan and risk acceptance where necessary. 

By encouraging open dialogue through the following questions, you can bridge the gap between the pentest team and the technical and non-technical stakeholders in your business. 

• Can we discuss any complex findings together to understand the adversary’s path and intent?  
• If we disagree on the severity of a finding, could you elaborate on your rationale in more detail?  
• Can you assist our technical team in mapping the findings to business processes so we can better assign ownership?  
• What findings might be misinterpreted by non-technical leadership, and how should we communicate them?

Assessing Risk and Prioritizating Remediation Efforts

When resources are limited, it’s crucial to identify which vulnerabilities require urgent action and which can wait a bit longer. By tackling these questions head-on, you can prioritize effectively, focusing on what truly poses a risk, and ensuring that your remediation efforts are both strategic and impactful.

• Which findings pose the greatest business threat when considering both their likelihood and potential impact, alongside the existing security controls?
  
  For instance, if a pentest revealed a weak password policy on low-privilege internal accounts versus high-privilege external accounts, the fix does not necessarily need to be urgent for the former—especially if accounts are isolated, there's strong segmentation, and strict account lockout policy for failed login attempts to thwart brute-force attempts to crack the password. However, the fix should be immediate for high privilege accounts.
  
  
• Are there vulnerabilities that directly affect compliance obligations?
  
  Should a web application disclose the profile data of other users—including names, email addresses, phone numbers, and dates of birth—due to the exploitation of a broken access control vulnerability, this would constitute an unauthorized disclosure of personal data and violate the General Data Protection Regulation (GDPR).
  
  
• Are there any unique vulnerabilities that could bypass current security measures or monitoring systems?
  
  For example, a cross-site scripting payload that can evade the web application firewall (WAF) in place.
  
  
• Were there any vulnerabilities reported that are currently under active exploitation in the wild, like zero-days or known exploits? 

Remediation Timelines

Here's a typical timeline for fixing vulnerabilities found during a penetration test. These timelines are based on risk and factor in the CVSS scores, how easily they can be exploited, their impact on the business, and existing controls.

The goal of time-bound risk acceptance is to acknowledge specific vulnerabilities, understand their potential impact, and set clear timelines for addressing them in the future. This approach balances security needs with practical business constraints, ensuring safety without unnecessary disruptions.

Conclusion

Ultimately, working with your pentesters is about more than just receiving a list of vulnerabilities. It's about gaining a deeper understanding of how these vulnerabilities fit into your organization's specific context and risk tolerance. 

By asking the right questions and having a collaborative conversation, you can uncover valuable insights that inform effective risk management decisions. By accepting that risk is time-bound, organizations can align their security priorities with business goals, ensuring that resources are used efficiently. 

The goal is to turn the results of a pentest into actionable plans that address immediate threats, and strengthen the organization's long-term security in a constantly changing threat landscape.