Reading a penetration test report: what to fix first

A report with forty findings is not forty tasks. Order the work like this.

1. Start with confirmed, exploitable issues

Look for findings the testers actually exploited, with steps you can reproduce. These are real, not theoretical.

2. Weigh impact, not only the score

A medium score on the system that holds your customers' data can matter more than a high score on an isolated test server. Ask what an attacker would gain.

3. Group by cause

Many findings share a root cause, such as missing input validation or a weak access check. Fixing the cause closes several at once.

4. Quick wins next

Configuration changes and updates that take an hour are worth doing straight away.

5. Re-test

Close a finding only when it has been tested again. Findings marked as leads rather than confirmed deserve a look, but after the confirmed ones.