How to provide management responses to pen-test findings

Last updated: September 16, 2025

When you receive a draft penetration test report, you have the opportunity to provide management responses to the findings before the final report is published. These responses help clarify your organization's position on each vulnerability and inform the remediation process.

What are management responses?

Management responses are comments that provide context about each finding from your organization's perspective. Common types of responses include:

  • Known vulnerability - Acknowledging that you're already aware of the issue

  • Prioritized - Indicating the finding is scheduled for remediation

  • False positive - Explaining why the finding doesn't apply to your environment

  • Intentional design - Clarifying that the behavior is expected and by design

  • Won't fix - Explaining business or technical reasons why remediation isn't planned

How to submit management responses

Once the draft report is uploaded to your evidence tab, you can:

  1. Review each finding in the draft report

  2. Use the comments function to leave your management responses

  3. Be specific about which findings you're addressing

  4. Provide clear reasoning for your response

Example management responses

Here are some examples of effective management responses:

  • "Names/emails/roles exposed: This is intentional and expected. We don't treat this data as privileged as it's already accessible in our internal org chart."

  • "Insufficient query access restrictions: All listed queries are meant to be visible to organization members - no action necessary."

  • "Session persistence after logout: Won't fix - we use stateless JWT with no good way to invalidate existing tokens on logout."

Retesting after remediation

If you plan to remediate findings, you can request retesting to validate your fixes. Medium-severity vulnerabilities should typically be remediated within 90-120 days. Let your security team know when you've completed remediation work to schedule a retest.

After providing your management responses, the final report will be updated and stored in the appropriate control for your records.