Skip to content

Automate Pentest Reporting

Writing the report is the part of a penetration test nobody enjoys, and the part that eats the schedule. Findings are copied from notes into a Word document, screenshots are pasted one at a time, severity tables are rebuilt by hand, and the executive summary is written at midnight before delivery. Faction is a pentest report generator that removes that step: findings are recorded once, in the tool, while you test, and the report is generated from them.

Your template, not ours

Most pentest reporting tools make you rebuild your report in their format. Faction generates reports from DOCX templates you design in Microsoft Word. Take the report you deliver today, replace the parts that change with ${variables}, upload it, and Faction fills it in. Fonts, headers, cover pages, tables of contents and branding all stay exactly as your designer left them.

A template can:

  • Repeat a table row or an entire block of formatted content for every finding, so a findings summary table and a per-finding detail section both come from a single row or block in the template.
  • Colour severity text and table cells automatically from a placeholder colour, so Critical is red and Low is green without touching each cell.
  • Split findings into named sections such as Web Application and Network, and drop a whole section when it has nothing in it.
  • Format dates, count findings per severity, list assessors, and link to CVSS calculators.
  • Print any custom field you have added to findings or assessments.

Reports are rendered to DOCX and PDF, optionally password protected, and kept on the assessment with their generation history. See Using DOCX Report Templates for every variable.

Findings written once, reused everywhere

A reusable vulnerability library ships with the product and is yours to extend. Adding a finding to an assessment starts from a library entry with the name, severity, category, description and recommendation already written, so a tester records what was found rather than retyping what cross-site scripting is. Content templates do the same for methodology sections, scope preambles and standard caveats. See Templating.

Report as you test

Findings are captured in the assessment as they are discovered. Screenshots paste straight into the finding, CVSS 3.1 and 4.0 vectors are scored in place, and the report can be generated and previewed at any point to see how it is shaping up. There is no separate "reporting phase" at the end of the engagement, because the report already exists.

Peer review built in

Before a report reaches a client it goes through a peer review queue with tracked changes and diffs. The reviewer sees exactly what changed, comments on it, and approves or sends it back. Checklists enforce that the methodology was followed before the assessment can be finalized. See Assessment Checklists.

Retest reports without starting over

A retest is scheduled against the original findings. Each one is re-verified, the ones that are fixed are closed, and the retest report is generated from the same template with open and closed counts, remediation status per finding and the dates each was opened and closed.

Try it

Faction is open source and self-hosted. Run it with one command, then follow Getting Started to generate a report from the default template in about ten minutes.