A pentest attestation letter is a short, signed document issued by a penetration testing provider. It confirms that a defined system or environment was tested during a stated period and summarizes the engagement at a high level. It provides shareable evidence of testing without the sensitive technical detail in the full penetration testing report.
A customer may ask for a "pentest certificate," procurement may request proof of security testing, or an auditor may want evidence that an assessment was completed. An attestation letter can help answer those requests, subject to the recipient's evidence requirements. It is not a security certification, a compliance certificate, or a guarantee that a system is free of vulnerabilities.
This guide is for security, procurement and sales teams preparing or reviewing testing evidence. It explains what the letter should include, how it differs from a report, when it should be updated and what to check before sharing or accepting one.
What is a penetration testing attestation letter?
A penetration testing attestation letter, sometimes called a letter of attestation or pentest completion letter, is a concise document confirming that an independent penetration test took place. The testing firm issues this signed document to record the assessment at a high level.
Depending on the engagement terms, it may be issued with the final penetration testing report or updated after a retest. Its purpose is to let an organization demonstrate that testing was completed without sharing vulnerability descriptions, proof-of-concept exploits, screenshots, credentials, architecture details, or remediation information from the full report.
The document usually answers five basic questions:
- Who was tested?
- What systems or applications were in scope?
- When did testing take place?
- How was the assessment performed?
- What was the status of the findings when the letter was issued?
That final point matters. An attestation letter issued immediately after the initial assessment may describe the findings identified during testing. A letter issued after remediation and retesting may instead confirm which findings were successfully resolved. The wording should reflect what the provider actually verified.
Why do companies ask for a “pentest certificate”?
Customers, partners, procurement teams and insurers sometimes use "pentest certificate" as informal shorthand for evidence of recent security testing. It does not identify one universally standardized document, and it should not be confused with a penetration tester’s professional certification.
Before sending anything, clarify what the requester needs. They may be asking for:
- A shareable confirmation that a pentest was completed
- The executive summary from the penetration testing report
- The full report, usually under a nondisclosure agreement
- Evidence of remediation or retesting
- A certificate or report tied to a specific framework, such as ISO/IEC 27001, SOC 2, or PCI DSS
If the request is simply for proof that an independent pentest took place, an attestation letter is usually the appropriate document.
What should a pentest attestation letter include?
There is no universal template, but a useful attestation letter should contain enough information for the recipient to understand what was tested and what the letter supports.
Organization and provider details
The letter should identify the organization that commissioned the assessment and the penetration testing provider that performed it. Include the provider’s contact details so a recipient can verify the document. It should be dated and signed by an authorized representative of the provider.
Scope of testing
The scope should identify the application, API, cloud environment, network, or other asset tested clearly enough to prevent the letter from being applied to systems that were not assessed.
This is especially important for organizations with several products or environments. A pentest of one SaaS application does not attest to the security of every application operated by the company.
Assessment dates and approach
The methodology summary should state the exact start and end dates and may describe the type of assessment, such as black-box, gray-box, or white-box testing. It may also name the principal methodologies used, depending on the scope, such as OWASP testing guidance, PTES, or OSSTMM.
High-level outcome
The outcome should be precise and limited to what the test established. Depending on when the letter is issued, it may summarize the number and severity of findings, state that remediation was underway, or confirm the status of findings after retesting.
Avoid vague or sweeping statements such as “the company is secure.” A penetration test is a time-bound assessment of a defined scope, not a guarantee about the security of an entire organization.
Limitations
A well-written letter should explain that the assessment was time-bound and limited to the agreed scope. It should not imply that no other vulnerabilities exist or that future attacks cannot succeed.
Attestation letter vs. penetration testing report
The attestation letter and the full report serve different audiences. If you need both, confirm that they are included in the engagement and agree when each will be issued.
The attestation letter does not replace the report. Your technical teams need the report to understand and fix the vulnerabilities identified. In some audit or vendor-review scenarios, the recipient may also require the report or selected sections of it.
For a detailed view of the main deliverable, read What to Expect From a Penetration Testing Report.
Attestation letter vs. compliance documentation
A penetration testing attestation letter should not be confused with evidence issued through a formal compliance or certification process.
A penetration test may support one or more controls or evidence requirements within these processes, but the pentest provider does not issue the resulting ISO certificate, SOC 2 report, or PCI DSS Attestation of Compliance merely by completing a pentest.
Read more about how penetration testing supports ISO 27001, SOC 2, and PCI DSS.
How to review a supplier’s pentest attestation letter
When a supplier sends you a letter, check whether it answers your security-review questions. A document confirming that testing occurred may still leave gaps about coverage or remediation:
- Provider and authenticity: identify the testing company, issue date and authorized signatory. If something is unclear, verify it through an independently obtained provider contact.
- Product and environment: confirm that the named application, API, infrastructure and production or staging environment match the service you will use. Note exclusions and differences between the tested environment and the deployed service.
- Timing and change: check the testing dates separately from the letter’s issue date, and ask whether material changes have occurred since testing.
- Assessment approach: establish what type of assessment was performed and whether its access, depth and limitations address the risks you need assessed.
- Findings and remediation: distinguish findings identified, fixes reported by the supplier, fixes independently verified and unresolved risk. A remediation plan is not evidence that fixes passed a retest.
- Evidence sufficiency: compare the letter with your review criteria. Request a redacted summary, relevant report sections or retest evidence through an agreed sharing process when the letter is insufficient.
When is an attestation letter useful?
Organizations commonly use attestation letters in the following situations:
Customer and vendor security reviews
Enterprise customers may request proof of recent penetration testing before onboarding a vendor, renewing a contract, or approving access to sensitive data and systems.
Procurement and sales processes
A shareable letter can help answer security questionnaires without distributing a confidential report to every prospect. It does not eliminate further due diligence, but it gives the reviewer clear evidence of the assessment.
Compliance audits
An auditor may accept an attestation letter as part of the evidence for a security-testing control. However, auditors can request the full report, remediation records, or retest results, so the exact evidence requirements should be confirmed in advance.
Cyber insurance
Insurers may request evidence of periodic security testing during underwriting or renewal. Whether an attestation letter is sufficient depends on the insurer and the wording of the questionnaire.
Partnerships, integrations, and due diligence
Business partners and investors may ask for independent confirmation that important systems have undergone security testing. The letter provides a limited disclosure option when the full report is too sensitive to circulate.
When should the letter be issued?
The right timing depends on what you need the letter to demonstrate.
An initial attestation letter records the assessment and its outcome when testing concludes. It proves that the work took place, but it may also show that unresolved findings remained at that time.
A post-retest attestation letter reflects the provider’s verification of remediation. This is often more useful when a customer or auditor expects confirmation that critical or high-risk findings have been addressed.
Retesting is not a new full penetration test. It verifies the remediation of previously reported findings. Changes outside those fixes, newly introduced functionality, and vulnerabilities that were not present or discoverable during the original testing may require a new assessment.
Can an attestation letter be shared without an NDA?
Attestation letters are designed to be easier to share than full penetration testing reports, but they are not automatically public documents.
Before forwarding one, check:
- Whether it identifies confidential applications, domains, IP ranges, or environments
- Whether it discloses the number or severity of unresolved findings
- Whether the pentest provider included distribution restrictions
- Whether your contract, internal policy, or customer agreement requires an NDA
If the recipient needs more assurance than the letter provides, consider sharing a redacted executive summary or arranging controlled access to the report rather than sending the complete report by email.
How long is a pentest attestation letter valid?
An attestation letter does not have a universal expiry date. It records the state of a specific scope during a specific testing period.
Its practical relevance decreases as the system changes. A new release, major architectural change, cloud migration, new authentication flow, significant integration, or material change to the attack surface can make an older letter poor evidence of the current environment.
A customer or assurance program may specify a maximum age for testing evidence. Check that requirement alongside applicable regulatory obligations, contractual commitments, risk and the rate of change in the system. A recently issued letter referring to an older test does not make that test more recent.
What to ask your pentest provider before the engagement
If you expect to use the assessment in customer reviews, audits, or insurance renewals, agree on the documentation before testing begins. Tell the provider about any compliance deadline or relevant audit period so the testing window, issue date and delivery plan address the actual request.
Ask the provider:
- Is an attestation letter included in the engagement?
- Will the letter identify the exact scope and testing dates?
- What will it say about findings and their remediation status?
- Can an updated letter be issued after retesting?
- How long is the retesting window, and is retesting included?
- Which testing methodologies and provider accreditations can be referenced?
- Are there restrictions on who may receive the letter?
Provider accreditation can also matter to the recipient. For buyers that require independently assessed testing providers, see our guide to CREST penetration testing.
Pentest attestation letters from Blaze
Blaze’s penetration testing services provide validated findings, business-impact context and remediation guidance for the agreed scope. When an attestation letter is included in your engagement, it provides a separate document for controlled sharing with customers and partners. Agree its scope, intended recipients and required wording before testing begins.
Blaze is a CREST-accredited penetration testing provider. Our assessments use manual testing supported by automated tools and methodologies appropriate to the target, and go beyond checklist coverage to examine the technology and business logic within scope.
Testing and report delivery dates are confirmed during scoping. Retesting inclusions, the validation window and any updated-letter process depend on the selected engagement. The Blaze Portal helps teams track findings, remediation and available fix-validation evidence; an updated attestation should reflect only the work and remediation the provider has verified.
Example: what Blaze’s sample letter shows
Download Blaze’s sample penetration testing attestation letter to see how the scope, assessment dates, testing approach, findings, and provider sign-off can be presented.
The sample uses a fictional client and application. It summarizes a staging-environment assessment, reports findings by severity, describes the client’s remediation plan, and explains the assessment’s time and scope limitations.
