The most important part of a penetration testing service is the quality of the deliverable to the customer. We have seen very talented testers lose business to low quality, yet more professional, service providers purely on the basis of the customer's reaction to the final report. This is due to the way the message is delivered considering the target audience, how sensitive they are to bad news, as well as the level of details provided. The best way to customize the message for a potential customer is to leverage a mix of standardized reports as well as imagine how they would read the material. For example, calling an individual a potential weakness would probably be a bad idea if that person has influence over the budget for this and other services.

Developing reports is not just documenting your findings. You need to capture the entire scenario including the environment prior to the penetration test, what information was provided upfront, assumptions about the current...