Security questionnaires commonly ask for the date of your most recent penetration test and whether you'll share the results. The question looks simple, and reps often answer it with "yes, we do annual pen tests" before checking what their company is actually willing to send. Then the buyer asks for the full report, security says no, and the deal picks up a small, avoidable bit of friction. Most penetration test questions from buyers can be settled in one email, if the rep knows what to offer in the first reply.

What a penetration test actually is

A pen test is a controlled attack on your own systems by people trying to find and exploit weaknesses. NIST's glossary describes penetration testing as a method where testers target individual components or the application as a whole to determine whether vulnerabilities can be exploited to compromise the application, its data or its environment (NIST glossary). NIST's SP 800-115 is the classic technical guide to planning and running security tests, and many testing firms describe their web application work against the OWASP Web Security Testing Guide.

The distinction buyers care about is between a pen test and an automated vulnerability scan. A scan runs a tool against your systems and lists known issues. A pen test involves people trying to chain weaknesses together and see how far they get. If your company runs both, say both, and don't let a scan stand in for a pen test in a questionnaire answer. Security reviewers can tell from the summary which one they're looking at.

If your company uses an outside testing firm, find out which one and when the last test finished. Then find out what was in scope, because that's the detail reviewers check first. A test of your marketing website tells them nothing about the application their data will live in.

Reviewers also look at how the test was run. An authenticated test, where testers log in with real user accounts, can probe what one customer might reach of another customer's data, which is exactly what a buyer of a multi-tenant product worries about. An unauthenticated test only sees what an outsider sees. Testers also describe their starting knowledge: in a black-box test they get almost nothing, while in a grey-box test they get some documentation or credentials. If the summary says the test was authenticated and covered the production application or a faithful copy of it, say so early. That one sentence answers the question most analysts are about to ask. If they go deeper into test methodology than you can follow, that's exactly the moment to bring in a sales engineer.

What you can send

Most vendors default to an executive summary or a letter of attestation from the testing firm, shared under NDA. Offer that first. "We can share an executive summary and the tester's attestation letter under NDA" usually ends the back-and-forth, and a trust center is often where both already live.

The summary usually runs a few pages: scope, test dates and a count of findings by severity, sometimes with remediation status. The attestation letter is thinner still. It confirms a test happened, when and against what scope, with no findings detail, and some buyers will take it on its own.

If the analyst pushes for the full report, expect resistance from your own security team. It's the tester's complete write-up, often with reproduction steps for every finding, which makes it a how-to guide for attacking your product even after the fixes. Plenty of vendors never share it; some do under NDA for large deals. Check your company's position before the buyer asks.

Reading the severity counts

The summary will almost always group findings by severity, and buyers will ask about the high ones. Many testers use CVSS, the Common Vulnerability Scoring System maintained by FIRST, to rate findings. The CVSS specification maps scores to ratings: 0.0 is None, 0.1-3.9 is Low, 4.0-6.9 is Medium, 7.0-8.9 is High, and 9.0-10.0 is Critical (CVSS v3.1 specification). Some firms use their own scale instead, so check the methodology section before assuming.

A summary with findings in it is normal. A test that found nothing at all can make a reviewer wonder whether the scope was too narrow. What reviewers want to see is that serious findings were fixed and checked.

Remediation status

Every pen test conversation ends up here. The buyer reads the summary, sees a High finding from four months ago, and asks whether it's resolved.

The strongest answer is that it was fixed and the testing firm retested and confirmed it. Some firms issue a retest letter you can share.

A finding can also be fixed internally without a retest yet, or still open with a remediation plan and target date. Occasionally a company formally accepts a risk and documents compensating controls. Each of these is a legitimate position for a real company to be in. The mistake is collapsing them all into "yes, it's all fixed." A buyer's security analyst will ask for the retest letter, and if it doesn't exist, the problem stops being the finding and becomes your credibility. Find out the remediation status of every High and Critical finding in the latest test before you send the summary.