What your child will learn
Outline the four sections of a professional pentest report: Executive Summary, Technical Findings, Remediation Roadmap, and Appendix
Write an executive summary in language a non-technical executive can act on, with the systemic risk-pattern and recommended next step
Write a single technical-finding block — Severity (CVSS), CWE, Affected Asset, Description, Evidence, Business Impact, Recommended Fix — in a format the engineering team can act on
Apply the rule: NEVER include working exploit code in a report — it is a perpetual liability (retention, distribution, accidental execution)
Practice the responsible-disclosure rule: redact production credentials, redact customer PII, redact exact hostnames/IPs for any third-party share
How this mission works
Write the actual deliverable. Four-section skeleton (Executive Summary / Technical Findings / Remediation Roadmap / Appendix). Executive reasoning in dollars and blast-radius, not raw CVE counts. Technical findings in the format the engineering team can act on without further questions. NEVER include working exploit code. The capstone has you write the redacted report for the in-browser sandboxed CTF.
What students actually encounter
A pentest report has four standard sections — in what order do professional readers EXPECT them?
What is the BEST metric to use in an executive summary to convey severity?
A report that includes working exploit code is a liability — why?
Cipher is with them the whole way
When a student gets stuck on Pen-Test Reporting 501 — Writing a Real Pentest Deliverable, Cipher appears with a mission-specific nudge — no spoilers, just a hint toward the right thinking. Make a wrong choice, and Cipher explains the real-world consequence. Finish the mission, and Cipher generates a personalized performance debrief based on exactly how the student played it.
ISTE alignment
Reasoning in dollars and blast-radius. The redaction rule in practice. CSTA 3A-NI-08 (cryptographic / tradeoffs in real-world contexts) + AP Cybersecurity's "Communication & Documentation" topic + ISTE Digital Citizen 2d (positive, safe, legal, and ethical digital behaviors including responsible disclosure).