How to read a penetration test report

Start with the access the assessment was asked to establish. Then trace the access it gained and inspect the evidence behind it. A useful penetration test report connects the starting position to the systems or data you need to protect.

In AutoAttack, the campaign page becomes the report. It contains the objective outcome and the attack path, with evidence beside each step. For published campaign results, see the lab research.

Separate the objective outcome from the campaign status

The objective states the access being tested, such as administrator access to a named server. Check that wording before interpreting the result. Access to a different server does not answer the same question.

The campaign status tells you whether the assessment is waiting, running, completed, stopped or failed. A completed campaign can leave its objective unreached. A stopped or failed campaign can still contain useful evidence of access gained before the interruption.

A reached objective means the campaign established the requested access. “Not applicable to this estate” is a separate outcome for an objective whose targets the assessment established were absent.

Distinguish access gained from attempts

The campaign shows evidenced access gained throughout the run and the recorded operations that enabled it. An operation can capture useful access before a later part fails. Each gain requires its own evidence.

For each gain, identify the target, the identity used and what became possible afterwards. A recovered service-account password and administrator access to a server are different gains, even when one leads to the other.

Read the target and access described by each gain together. The number of gains is neither the number of systems assessed nor a measure of severity. One server can appear more than once when the campaign establishes different access to it.

Each domain has its own track to its administrator result. Host, tenant and resource objectives use tracks for their respective targets. Step numbering starts at one within each track. Shared prerequisite actions appear in each track that consumed them, and the step links stay within that copy.

Use the track index to find a scope. Scopes without access gains share a disclosure at the end of the report. A domain with administrator access does not establish success in another domain.

Check what the evidence actually establishes

Open the relevant step and compare its captured output with the claim. Different evidence supports different conclusions:

• Collecting material for offline password recovery does not establish that the password was recovered.
• A successful login establishes access as that identity. Administrator access needs evidence of the greater privilege.
• An application error can reveal useful information. A claim that records were retrieved needs evidence of the data obtained.

These are examples of how to interpret evidence, not results from a particular campaign.

Follow the route as well as the individual steps. The report connects the earlier credentials or permissions that enabled each gain. Open the captured evidence beside a step to inspect its result.

Open Evidence to inspect captured output for a result. Follow its input links to the steps that enabled it.

Work through a report conclusion

Consider a hypothetical campaign whose objective is administrator access to backup-01. It starts with an employee account. The report marks the objective reached and shows a recovered backup service credential followed by administrator access to that server.

To assess that conclusion, inspect the evidence for each gain. Suppose it shows that the employee account could read a configuration file containing the service credential, and that the recovered credential enabled the administrator access. The input link connects the exposed credential to the access gained.

A handoff to the system owner could say: “The supplied employee account could read a backup service credential from a configuration file. The campaign used that credential to obtain administrator access to backup-01, reaching the stated objective.” Attach the relevant evidence and identify the file and account in the handoff.

This example gives the owner a specific exposure to investigate. They can review who needs access to the file and which services depend on the credential before changing it. It also keeps the conclusion within the evidence: administrator access does not establish that backup data was destroyed or that recovery was tested.

Plan the next campaign from its results

The summary counts all distinct access gains and shows gain times. Review each achieved result and the remaining objective conditions, then check the starting position, credentials, scope, exclusions and permitted actions for the next campaign.

Look for the reason the run stopped and the furthest access it achieved. An unreachable target, an unsuccessful attempt and an interrupted campaign leave different questions open. Use the stopping point to decide what to investigate or retest.

If a report has no gains, confirm that the agent connected and check the campaign status. Read the objective outcome and review the deployment position and authorized scope. Contact support with the campaign identifier and any visible error if the agent failed to connect or the campaign failed.

A failed campaign offers Review settings for another run. That opens a new draft with the objective and settings preserved. Starting credentials remain blank, and the new campaign requires authorization before it starts.

Turn the route into remediation work

Use the weaknesses and remediation advice beside the steps to identify the condition that enabled access. An exposed password, an excessive permission and a reused credential call for different changes. The system owner should decide how to make the change and what dependencies it affects.

Afterwards, define what would demonstrate that the condition has changed. A repeat assessment must reach and test the relevant system or permission again. If an earlier step now fails, the campaign may never test the later weakness.

AutoAttack campaigns are independent. Set a new campaign's objective and scope to test the affected system or permission, then review the evidence of the new result.

Know what the free report includes

Before subscribing, you can read the campaign's steps, technique and weakness labels, counts and access kinds. Anonymous target labels stay consistent within that campaign, so you can follow the same target across steps.

A subscription reveals target identities, captured evidence and remediation advice. See annual host pricing and the quickstart to prepare your first campaign.