What a Red Team Report Contains

A penetration test report is a catalogue. A red team report is a story. If you receive a severity table and little else, the exercise has been misunderstood or misdelivered.

The attack narrative

The core of the document: what happened, in order. Reconnaissance and what it revealed. The routes considered and why one was chosen. The initial access attempt — what worked, and what failed first. What was found inside. How the objective was reached, or where the team was stopped.

Written so that someone who was not there can follow it. It is the section that gets read aloud in a board meeting, and the one that changes minds, because it is a description of your organisation rather than of a vulnerability class.

The detection timeline

The deliverable people underestimate, and frequently the most valuable page.

Every action the team took, mapped against what your side saw: logged and alerted, logged but silent, or invisible. With timestamps on both, so a delay is visible as a delay.

This converts "our monitoring is good" into a list of specific techniques that produced nothing. It is also the only part that measures your response rather than your tooling — an alert that fired at 02:14 and was acknowledged at 09:30 is a different finding from one that never fired.

If the detection timeline is not in the proposal, it will not be in the report. Ask before signing — see what a red team engagement costs, where it is one of the five comparison questions.

Findings, written to be fixed

The narrative explains; the findings section is what engineering works from. Each one conventional: what the weakness is, where, evidence, and specific remediation.

Expect them to be a mixture, and expect that to be the point. A red team usually surfaces a handful of technical flaws alongside process and human findings — a service desk that resets a password on a convincing phone call, a door held open, a monitoring rule scoped to the wrong log source. The non-technical ones are frequently the cheapest to fix and the hardest to hear.

What should not dominate it

CVSS scores. They describe a technique's severity in the abstract, and a red team's finding is usually the chain — three individually moderate things that together reached the objective. Scoring each link separately understates all of them.

A report that leads with a severity distribution is a penetration test report with a red team's name on the cover.

The debrief is part of the deliverable

The most useful hours of the engagement are usually the joint session: the red team and your defenders walking the timeline together. Here is when we did that — did you see it? What did it look like on your side? Why did that rule not fire?

It is cheap, it is frequently omitted from proposals, and it is where the detection improvements actually get designed. Ask for it explicitly.

Then what

Unlike a penetration test, there is rarely a clean retest: the objective was achieved by one route, and the fix changes the terrain rather than closing a finding. What usually follows is detection work, verified through a purple team exercise, and a repeat engagement later against a different objective.