T34 Penetration test findings readout

Penetration test findings readout

A penetration tester presenting findings to technical leads

Acme, external + cloud identity Test window: Sep 1 to Sep 10, 2026 2 Critical findings 2 already closed

What Stonebridge Security found in Acme's external and cloud identity penetration test, and the owners and dates agreed for each finding. Prepared by Sara Ortiz, Lead Penetration Tester, for Acme's technical leads.

Engagement scope

Sample template: the firm, people, clients and figures are fictional, and the embedded view holds synthetic sample records.

Findings register

The register below tracks every finding Stonebridge has open or recently closed across clients, sorted by target remediation date. Acme's four findings, listed above and in the tabs below, sit among them today.

Before you share this page with a client

The findings register embedded above holds findings for every Stonebridge client. Before sharing this readout, switch the embed to a saved view filtered to Acme, or duplicate the page and filter it first.

Cloud root account without MFA

The cloud hosting root account had no multi-factor authentication enabled, found through the account security page. Severity Critical. Remediation: enable hardware key MFA and store recovery codes in the vault. Owner: Dana Fox. Target: Sep 24, 2026. Status: Ready to verify, evidence pending your sign-off.

Open storage bucket

A media storage bucket allowed public read access, confirmed through a public bucket listing. Severity Critical. Remediation: removed public access and reviewed contents. Owner: Dana Fox. Closed: Sep 12, 2026. Verification: access test now returns denied; the log is retained as evidence.

Dormant admin accounts

Six admin accounts on the identity provider had no sign-in since June. Severity High. Remediation: disable the accounts and require approval to reactivate. Owner: Dana Fox. Target: Oct 3, 2026. Status: Assigned, disabling in progress.

How these findings chain together

flowchart LR
    A[Unauthenticated attacker] --> B[Cloud root account, no MFA]
    B --> C[Full control of hosting account]
    C --> D[Dormant admin account, identity provider]
    D --> E[Access to internal systems as admin]
    C --> F[Public storage bucket]
    F --> G[Customer data exposed without any further access]

The storage bucket exposure required no other weakness, which is why it was fixed first. The root account and dormant admin findings matter together: a root account compromise combined with an unreviewed admin account gives an attacker a path that survives a single password reset.

Remediation SLA by severity

Severity	Target to remediate	Verification required
Critical	7 calendar days	Stonebridge retest or client evidence, tester sign-off
High	30 calendar days	Client evidence, tester spot check
Medium	60 calendar days	Client evidence
Low	Next scheduled maintenance	Self attested by client

Caveats

What this test does and does not tell you

Findings reflect the systems in scope during the Sep 1 to Sep 10 window; a configuration change after the test is not covered until the next assessment. No destructive testing was performed and no data was exfiltrated beyond confirming access was possible. This is a point in time assessment, not continuous monitoring.

Decisions for the readout call

Confirm Dana Fox as remediation owner for all four findings, or split ownership.
Approve the Oct 3 target for dormant admin accounts or request an earlier date.
Agree whether Stonebridge retests all four findings or only the two still open.
Decide whether the dormant admin account review becomes a recurring quarterly check, not a one-time fix.

How to use this template

Duplicate this page once per client per engagement. Replace these values; if a required value is missing, show Needs review instead of guessing.

Variable	Meaning	Required
`{{client.name}}`	Client the penetration test covers	Required
`{{engagement.test_window}}`	Start and end dates of the testing window	Required
`{{engagement.scope}}`	Systems in scope and explicitly excluded	Required
`{{finding.severity_counts}}`	Count of findings by severity	Required
`{{finding.remediation_owner}}`	Client owner named for each open finding	Required when a finding is open
`{{engagement.retest_date}}`	Date of the agreed retest	Optional

Before sharing: confirm the embedded register is filtered to this client only.