Some, but not all customers will want a presentation to go with the report.
Why?
Well,
it can help to transfer more knowledge about results, and
it's also a different medium to the report.
Some people absorb information more easily from a presentation.
It's also a good opportunity for customers to ask questions about findings.
To many pen testers, this might seem like even less fun than writing the report.
It can, however, be an excellent learning opportunity.
If a finding wasn't well communicated, then you'll get a lot of questions.
If a finding was a false positive,
then you might find out why. This can all help your future reports be better.
What should the presentation look like?
Often,
it's just a walkthrough of the report with questions
along the way. It is a good idea to check what the
customer wants from the presentation.
Given the report, they may want focus on specific findings.
They may also want some of their non‑technical people there.
If the technical team at Carved Rock need budget to fix findings,
then they'll want focus on likelihood and impact
with budget holders in the room.
If the presentation is with non‑technical and technical stakeholders,
then it's polite not to waste people's time.
This would typically mean putting the non‑technical parts of the
presentation first. Both sets of stakeholders can benefit from it.
Then, when it gets to the technical,
the less technical people can leave the meeting if they wish. The goal of
the report and the presentation are really the same.
We're just using a different medium to achieve them.
We've already detailed vulnerabilities in the report.
Sometimes having Kim talk about them is more important
than hyperlinks to technical articles.
Maybe the team doesn't know the subject very well or will absorb
that information more easily when they can ask questions. For
mitigations, they may also have questions.
Were there multiple ways to mitigate a vulnerability?
If so,
which fits better with Carved Rock and why? Highlighting the
risks, for the non‑technical side, they may have questions
about how to interpret risk scores.
What does high really mean?
How worried should they be about something rated low? Expect questions.