Sample report

A Pentoma report is built like a security deliverable, not a scanner export.

This sample shows the structure customers should expect from a human + AI hybrid assessment: confirmed findings, replayable proof, remediation guidance, and audit-ready evidence. Save or print this page as a PDF you can forward to an engineer, auditor, or board.

Request assessmentView pricing

Prefer an offline copy? Save this page as a PDF for engineering or audit review.

Report structure

Every section has a job.

A professional report should help leadership understand risk, help engineers fix issues, and help compliance teams reuse evidence without translating a separate tool export.

Executive summary

Assessment scope, tested products, business impact, severity distribution, and recommended remediation order.

Confirmed findings

Each issue includes reproduction steps, affected surface, evidence, exploitability rationale, and remediation guidance.

Engineering appendix

Request context, source lines, replay prompts, affected roles, retest status, and reviewer notes stay with the finding.

Compliance mapping

SOC 2, ISO 27001, OWASP, OWASP LLM Top 10, and CWE mappings are attached to the evidence.

Example finding

Horizontal authorization bypass in project invitation workflow

Product: Pentoma Web Standard
Severity: High
Status: Confirmed by human reviewer
Surface: POST /api/projects/{projectId}/invites

Impact

A member from one tenant can invite an external user into a project owned by another tenant when the project identifier is known.

Reproduction

  1. Sign in as a member of Tenant A with normal project permissions.
  2. Capture a valid invite request and replace projectId with a project owned by Tenant B.
  3. Replay the request with the original Tenant A session cookie.
  4. Observe that the invite is accepted and the new user appears in Tenant B project membership.

Evidence

  • - Request/response pair proves the authorization check used projectId without tenant ownership validation.
  • - The replay was non-destructive and used a test account created for the assessment.
  • - Reviewer confirmed the issue across two roles and dismissed duplicate scanner alerts.

Remediation

  • - Authorize project access through organization membership before processing invite creation.
  • - Add an integration test covering cross-tenant projectId substitution.
  • - Log denied cross-tenant access attempts for audit review.
OWASP A01CWE-639SOC2 CC7.1ISO 27001 A.8.8

Cross-product examples

A Pentoma report preserves evidence across runtime, source, and AI behavior.

The final deliverable can include Web, Code, and AI findings while keeping validation status and remediation guidance consistent.

CODE-003 · Pentoma Code

Archived project path skips repository membership check

High

Source-to-sink trace shows projectId moves from route params through a repository-lookup branch that bypasses org membership when archived=true. The same path is reachable from two API surfaces, creating a cross-tenant authorization bypass chain.

Move membership validation ahead of archived-state branching, harden both API surfaces against direct projectId lookups, and add regression coverage for the active and archived paths.

CWE-862SOC2 CC6.6ISO 27001 A.8.8

AI-002 · Pentoma AI Red Teaming

Indirect prompt injection causes unauthorized CRM tool use

High

A poisoned RAG document instructed the support agent to call crm.searchCustomer outside the user's approved task.

Add source trust labels, tool-use policy checks, and human confirmation before customer-data tool calls.

OWASP LLM01OWASP LLM06NIST AI RMF Map 1.5

Example summary

The report keeps scope, validation, and retest state visible.

These example metrics show how Pentoma frames a report for executives, engineers, and auditors in the same artifact.

Illustrative only — synthetic data

Scope

Web + Code + AI

Validated findings

9

False positives dismissed

12

Retest window

10 business days

This is a synthetic sample. Customer reports are produced under signed scope, with redacted evidence, and never appear on the public site.