# Write a security finding for a penetration test report

Turns your notes on a vulnerability into a clear, professional finding with risk rating, evidence, impact, and fix steps.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Write, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/write-a-security-finding-for-a-penetration-test-report

## Prompt

```text
Write a security finding for a penetration test or security assessment report.

**Vulnerability title:** [e.g. "Stored cross-site scripting in comment field"]
**Affected asset:** [URL, endpoint, host, app version - anonymize if needed]
**What I found and how:** [my notes: steps to reproduce, requests and responses, screenshots described]
**Impact I could demonstrate:** [what an attacker could actually do]
**Rating method:** [e.g. CVSS v3.1 / v4.0, or our internal high/medium/low scale]
**Report audience:** [technical team / executives / both]

Write the finding with these sections:
1. **Title**
2. **Summary:** one or two sentences a non-technical reader can follow.
3. **Severity and rating:** proposed rating with the vector or reasoning, plus likelihood and impact in my environment. Mark the score [CONFIRM] for me to validate.
4. **Description:** what the weakness is and why it exists.
5. **Evidence and steps to reproduce:** numbered, precise, based only on my notes. Do not invent requests, payloads, or output; mark gaps [ADD EVIDENCE].
6. **Business impact:** realistic consequences, without exaggeration.
7. **Recommendations:** the root-cause fix first, then short-term mitigations, with how to verify the fix.
8. **References:** relevant categories such as the CWE or OWASP entry, named generically if you're not sure of the exact ID [CONFIRM].

Use precise, neutral language: no blame, no hype. Remove any credentials, tokens, or customer personal data from the evidence and note that it was redacted.
```

## What to fill in

- e.g. "Stored cross-site scripting in comment field"
- URL, endpoint, host, app version - anonymize if needed
- what an attacker could actually do
- e.g. CVSS v3.1 / v4.0, or our internal high/medium/low scale
- technical team / executives / both
- CONFIRM
- ADD EVIDENCE

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.