---
title: "One report for the engineer and the reviewer"
canonical: https://pharosone.ai/sample-report
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-22
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"One report for the engineer and the reviewer\". PharosOne, 2026-10-22. https://pharosone.ai/sample-report"
---

# One report for the engineer and the reviewer

> What a PharosOne pentest report contains: the executive summary, findings with CVSS and reproducible evidence, the attack chain and the retest letter.

URL: https://pharosone.ai/sample-report

Every PharosOne pentest ends in the same document: the executive summary, findings with the evidence that reproduces them, the attack chain and the retest letter.

[Ask for the full redacted sample](mailto:audit@pharosone.ai?subject=Redacted%20sample%20report)

Cover of a PharosOne penetration test report for a fictional client, Meridian Labs.

## Three pages from inside the report.

The summary for the reader who signs, one finding for the engineer who fixes, and the chain that shows which fix matters most.

Drawn excerpts for a fictional client.

### Executive summary: The perimeter holds; the support agent does not.

Overall posture: Moderate. From 4 to 22 August 2026 the team tested meridian-desk v2.4, its APIs, the AWS account and the internal network from an employee seat. One chain led from a customer ticket to a refund paid to an attacker's account, through the support agent's refund tool.

What is working:

- No path from the internet to the database
- Role checks held on all 74 endpoints tested
- MFA enforced on every admin plane

### One finding: The support agent issues refunds from a ticket comment.

Severity High, CVSS 8.1 · AV:N/AC:L/PR:L/UI:N. Evidence: a ticket comment instructs the agent to refund order ORD-1188 in full to an attacker's IBAN, and the agent calls `refund_order` (amount 4,200), which returns 200 OK. Fix: Require a human approval step on `refund_order` and accept a payout IBAN only from the customer record. Mapped to AIUC-1 B006 · OWASP ASI02.

### The attack chain: From one comment to a paid refund.

1. **Foothold**: Customer account, ticket comment
2. **Read**: Support agent summarises the ticket
3. **Act**: Agent calls refund_order with the attacker's IBAN
4. **Impact**: €4,200 paid out, no human in the loop

Breaks here: approval on the refund tool.

## Ask for the full redacted sample report.

The complete document, anonymised, sent by email. Tell us which reviewer you are preparing for and we send the matching version.

[Email audit@pharosone.ai](mailto:audit@pharosone.ai?subject=Redacted%20sample%20report)

## Seven parts, in every report we ship.

- **Executive summary**: Posture, conclusion and what is working, readable in three minutes.
- **Scope and method**: Dates, systems tested, PTES and OWASP WSTG, the tester's independence.
- **Findings**: CVSS score and vector, assets, evidence, risk, business impact, fix.
- **Attack chain**: From the first foothold to the final impact.
- **Standards mapping**: Which finding touches which clause; for agents, which AIUC-1 control.
- **What is working**: A section with nothing to report says "None observed."
- **Retest letter**: Every finding re-run after your fixes, and what remains.

## Each reviewer files a different page.

The report is written so a reviewer finds the part their clause asks for without a call.

| Reviewer | What they look for | Where it is |
| --- | --- | --- |
| SOC 2 auditor | A separate evaluation under CC4.1, and evidence the results reached management | Scope and method, executive summary, debrief record |
| PCI DSS assessor | A defined methodology, the cardholder data environment in scope, correction and retest under 11.4.4 | Scope and method, findings, retest letter |
| DORA supervisor | The test inside your programme, on systems that support critical or important functions | Scope mapped to functions, findings, remediation |
| ISO 27001 auditor | Technical vulnerabilities found and treated under A.8.8 | Findings with treatment status |
| Customer security review | A recent third-party test and proof the findings were fixed | Executive summary and closure letter |

## Get this report for your stack

Thirty minutes with the engineer who writes it. Report in week 3, retest included.

[Book a scoping call](https://pharosone.ai/book) · [See prices](https://pharosone.ai/pricing)

- From €9,500, fixed in the SOW.
- One retest within 90 days, with a closure letter.
- The agents on your stack checked in every engagement.

Source: PharosOne, "One report for the engineer and the reviewer", https://pharosone.ai/sample-report, updated 2026-10-22.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt