Reports and branding
Find and download published PDF reports, understand report types and the QA steps behind them, and see how compliance mapping and branding work.
Open Reports in the sidebar to see reports for your engagements. Client Developers do not have Reports access.
You see published reports only
Every report passes through these states before it reaches you:
| State | Meaning |
|---|---|
| Draft, Generating, Ready | The pentester assembles and renders the PDF |
| In review | A QA reviewer checks it against a checklist |
| Approved or Rejected | Approved reports wait for publishing; rejected ones return for rework |
| Published | Released to you |
The QA checklist covers scope accuracy, CVSS accuracy, evidence quality, remediation quality, report formatting and classification. Reports carry a draft watermark until they are approved. An engagement manager publishes the report; until then you will not see it, even after delivery. A report is usually generated automatically when an engagement enters QA review.
Select Download for a PDF, or Preview to read it in the browser. Download links are short-lived, valid for about five minutes, so select Download again if one lapses.
Report types
| Type | Purpose |
|---|---|
| Pentest report | Findings with evidence, CVSS and remediation steps |
| Executive summary | Overview for leadership |
| Retest report | Which fixes passed or failed |
| Compliance report | Maps findings to framework controls |
| Attestation letter | One-page confirmation that testing took place |
| Trend report | Change across engagements |
| Remediation guide | Developer-focused fix instructions |
Attack surface summary reports are available when attack surface monitoring launches.
Compliance mapping
Compliance reports link each finding, through its CWE, to controls in PCI DSS v4.0, SOC 2 trust services criteria, ISO 27001, HIPAA and OWASP API Security Top 10 (2023); pentest reports also map to OWASP Top 10 (2021). Each control is marked Pass, Partial, Fail or Not Tested from the status of its linked findings.
This is an informational mapping. It is not an audit, an assessment of your compliance, or a certification, and it does not replace an assessor’s judgement.
Branding
Reports carry TrekShield branding and a “Confidential” marking, and each has a document reference. Platform administrators have a Report Branding page for classification label, footer text and accent colour, and a Report Templates page. Customers cannot change these.
Reports are issued under the TrekShield name. Customer-branded or white-label reports are not offered.
Next: report-related troubleshooting.
Last updated: 2026-10-18