Every pentest finding, translated into English.

Pentest reports are written in a dialect called Polite Panic. Here is the dictionary.

Security reports have a tone. Calm. Measured. Professional. The tone exists because the alternative is writing “HELLO??” in 48-point font on page one, and the lawyers have asked us to stop doing that.

So here is what the findings actually mean, for anyone who has ever received one and nodded slowly.

CRITICAL  Remote code execution
          I am your server now. Please do not turn me off.
          I have made friends with the cron jobs.

HIGH      SQL injection on the login page
          Your login page has a second, secret login page.
          It is the database. Everyone is admin.

MEDIUM    Outdated JavaScript library
          Every report has this one. It is load-bearing.
          Remove it and the whole PDF collapses.

LOW       Verbose error messages
          Your app told me the framework, the version,
          the file path, and something about its childhood.

INFO      Missing security headers
          It was 2am and page 38 looked empty.

Severity is a negotiation. A finding is born Critical, gets argued down to High in the readout meeting, and is quietly “accepted as a business risk” by someone whose name you will never learn. It then lives in a spreadsheet forever, like a ghost with a ticket number.

The retest is my favourite part. The client says it is fixed. It is fixed. In one place. The other nine endpoints that share the same code are still holding the door open and waving.

Every report ends with the same recommendation, and I would like it printed on a mug: please update your software. Not because it is clever. Because somehow, every single year, it is still the answer.