Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Pentest reports are the deliverable everyone hides behind an NDA. That makes them impossible to compare before you buy. This is a full anonymized Astra VAPT report where every section, write-up, and test category is included so you can judge our work before you commission it.
What's inside?
Two checklists in one, across 15 device and infrastructure types:
The executive summary - scope, dashboard graphs, severity breakdown, and the vulnerability register the way a CISO reads it.
Four full vulnerability write-ups - missing API security headers, stored XSS, SQL injection, and a smart contract constructor bug, each with CVSS score, impact, PoC, steps to reproduce, and suggested fixes.
The full test catalog - OWASP Top 10 for web and mobile, SANS 25, 174 additional test cases with severity, server-level and SSL/TLS tests, Windows and Android/iOS test cases, cloud tests for AWS/Azure/GCP, and 37 blockchain tests.
What you’ll learn
By the end, you'll be able to:
Benchmark what a real pentest report should contain.
Read a vulnerability write-up the way a developer needs it: CVSS, impact, reproduction steps, tailored fix, references.
Compare vendor reports on structure and rigor.
Specify what your next internal or third-party audit should deliver, down to the report format.
See exactly which test categories run behind an Astra audit, including the ones most vendors leave off.
Most pentest vendors won't show you a sample report until you've signed the SOW. This is ours, anonymized in full, before you commit to anything.
Who’s this for?
Read this if you're a…
CISO or CTO evaluating pentest vendors.
VP Engineering or Head of Security about to sign a pentest SOW and want to know what the deliverable actually looks like.
Procurement or compliance lead comparing offers side by side and want a benchmark.