What is a pentest letter of attestation?

Once you’ve had a penetration test, customers will ask to see it. You usually shouldn’t send the full report: it describes your weaknesses in enough detail to use them. What you send instead is a letter of attestation.

What it is

Packetlabs, a penetration testing firm, defines it this way¹:

A penetration testing letter of attestation is a formal document issued by a cybersecurity provider after a penetration test engagement. It confirms that testing occurred, outlines the scope at a high level, and summarizes the outcome of the assessment.

You’ll also see it called a completion letter or a summary letter. Stingrai, another testing firm, describes it as “a one-page document that confirms a qualified firm tested a defined scope over defined dates, with an overall risk statement and no exploitable detail.”²

The name causes one common mix-up. A SOC 2 report is itself an attestation: an examination “performed by a licensed, independent CPA under the AICPA Attestation Standards.”³ A pentest letter is something else. As Stingrai puts it, the letter “is not a compliance attestation, an audit opinion, or a certification of any framework.”² It’s one piece of evidence that can sit inside a SOC 2, not a substitute for one.

Who asks for it

Vanta lists the usual readers: a pentest report or letter of attestation “is often required by your regulators, insurance companies, and your clients.”⁴ Packetlabs describes the moments it gets used: “responding to customer security questionnaires, meeting vendor onboarding requirements, supporting compliance initiatives, or accelerating procurement reviews.”¹ In practice it gets attached to:

• Security questionnaires that ask whether you’ve had a third-party pentest
• Vendor onboarding and procurement reviews
• Cyber insurance applications¹
• Your trust page, for prospects who ask before a sales call

Auditors are different. Packetlabs notes that “auditors may still require direct access to reports in some situations.”¹ Plan to give your SOC 2 auditor the full report, and keep the letter for everyone else.

What it contains

According to Packetlabs, a letter often includes¹:

• The name of the organization tested and the testing provider
• The assessment dates
• The scope of testing and the methodology used
• A high-level summary of findings
• Confirmation that identified issues were remediated or addressed, if applicable

And it leaves out the dangerous parts. Unlike the full report, it avoids “exploit paths, screenshots, IP addresses, payloads, or infrastructure diagrams.”¹

How a reader knows it’s genuine

A letter is only useful if the reader can trust it. Packetlabs says it “should be issued on official company letterhead and include an authorized signature from the testing provider.”¹ Stingrai adds that a good letter names a point of contact who can confirm it’s authentic when a third party calls to check.² Some providers publish the proof instead: Astra gives “a publicly verifiable penetration testing certificate” once remediation and rescans are complete.⁵ A link anyone can open is faster than a phone call, and it doesn’t depend on someone answering.

Mistakes that make a letter useless

• It’s old. “An attestation letter from several years ago may raise concerns rather than build trust.” Packetlabs adds that many enterprise customers expect annual testing at minimum.¹
• It’s vague. A letter should say what was tested, when, by whom and whether issues were addressed.¹
• It overstates the test. If the test was automated and external, the letter shouldn’t read like a manual application pentest.
• It stands in for fixes. “A letter of attestation is not a substitute for remediation, secure development, or ongoing security practices.”¹

How Pentrail’s letter works

Every Pentrail report comes with a one-page letter of attestation for the domain you tested. The letter carries a public link: whoever receives it can open the link and check that the letter is genuine, without emailing anyone. The full PDF report stays with you and your auditor.

The report behind the letter states its scope and methodology (OWASP WSTG v4.2, PTES and NIST SP 800-115): an automated, external, non-destructive test of one domain whose owner proved control of it. It doesn’t cover testing behind your login, so present it as what it is, an automated external test, not a manual pentest. You also get three free retests within 30 days, so you can fix findings before you share anything. The whole package costs $20 per domain.