From the field. The tester tailgates through the speedgate without a badge. No one challenges him. Further along, a door to a protected area stands open.
That is a clear finding. Yet it does not yet dictate what must change tomorrow. An extra sticker on the speedgate? Training for everyone? A new access installation? Those who choose a solution too quickly may be treating the visible moment rather than the root cause.
For us, a report is therefore never the end product of a pentest. The value is created in the translation to risk, cause, owner, measure, and a new practical test.
A finding is only closed when the route has been broken not just on paper, but in practice.
First, understand what actually happened.
The speedgate functioned technically. The employee had a valid badge. The tester used no force and bypassed nothing. He tailgated during a busy moment, with his hands full and a story that sounded credible enough.
The observation, then, is not simply that the speedgate failed. Perhaps tailgating had been a normal exception for months. Perhaps there was no hospitable way to stop someone. Perhaps no one knew where to report a suspicious situation.
That distinction is vital. Otherwise, a technical installation is replaced while the same routine persists around the new equipment. That is the illusion of security with a newer device.
Recurring in our tests
Heavy structural measures surrounding a room, while the weakest link sits at the reception desk or with a supplier using a generic badge. The money has been spent, but the risk has not decreased.
One finding, five steps
1. Translate access into a business risk
“Someone was able to tailgate” is not yet a business risk. The question is what became accessible behind it. Confidential files? A server room? A production environment? Employees working with sensitive information?
In this example, the speedgate turns out to provide access to a floor with a technical room. The impact is therefore greater than unauthorized presence in a general office zone. The risk owner can now make a decision based on the affected business interest.
2. Find the cause behind the moment
Examine the entire route. How busy was it? Was the tester seen? Is challenging others normal in this culture? Does the reporting route work? Does reception receive information about maintenance and visitors?
The cause can be distributed across people, process, and technology. That is often exactly why a finding remains unresolved: every department only sees its own piece.
From the field
The name and logo of a contracting party were identifiable from public sources. Wearing counterfeit company clothing and carrying a toolbox, the auditor reported to the supplier entrance of a data center. He was let through. Attention was focused on the main entrance; the supplier entrance proved to be the path of least resistance. Improving only the main entrance does not close the route that actually worked.
3. Choose measures that fit together
In the speedgate example, the solution may consist of a clearer visitor process, a short exercise with employees, and an adjustment to the follow-up procedure. Technology may also be needed, but only after it is clear which problem that technology must solve.
An alarm without a practiced follow-up is just noise. A procedure that no one can apply in a busy situation is just text. Measures must work together to close a single route.
4. Record owner, deadline, and result
“Re-informing employees” is not a completed action. A good improvement agreement states who is responsible, when the change will be ready, and how you will see that it works later on.
For this finding, that might be: the facility manager adjusts the visitor process, the security manager sets up the reporting route, and the process owner accepts the residual risk. The result is concrete: a stranger can no longer tailgate unchecked, and a report reaches the correct official within the agreed time.
5. Test the same route again
Implementation is followed by a retest. Not to penalize employees for the previous incident, but to see if the combination now holds up.
The tester attempts to tailgate again. Is he challenged? Is verification easy? Does the report arrive? Does someone react? Only then does it become clear whether the measure exists and works.
Evidence on three levels
For follow-up, we use one simple line: design, existence, and operation.
The design describes how the measure is supposed to work. The existence shows that it has actually been implemented. The operation is proven through an inspection, exercise, or retest. These three prevent an updated document from being confused with a resolved risk.
| Level | Speedgate Example | Possible Evidence |
|---|---|---|
| Design | Visitors and employees are admitted separately | Updated process and assigned roles |
| Existence | Reporting route, instruction, and technical settings are implemented | Registration, observation, and accessibility test |
| Operation | A new tailgater is stopped and correctly reported | Unannounced retest |
For management, this overview is often more useful than a long list of actions. It shows which risk remains open, whose turn it is to act, and what evidence is missing.
The criminal attack cycle as a benchmark
An attack on a location does not start at the door. Anyone wanting to get inside typically goes through eight phases: target selection, intelligence gathering, onsite observation, planning, resource acquisition, a dry run, execution, and escape. Cocoon uses that criminal attack cycle as a benchmark.
Reporting follows these same phases. Vulnerabilities are identified and improvement advice is given for each phase, and the phase receives a final assessment. These assessments come together in a dashboard, showing at a glance where an attack could be detected and where it could not.
When is the finding truly finalized?
Not every risk needs to disappear completely. Sometimes the authorized owner accepts a residual risk, for example, because a structural adjustment can only be made during a planned renovation. In that case, record the reason, temporary measures, and the reassessment date.
An individual finding can be closed when the measure has been implemented, operation has been demonstrated, and the residual risk has been consciously accepted. Broader security remains fluid. Employees change, suppliers come and go, and the technical room may be open again during maintenance.
Therefore, periodic penetration tests complement targeted retests. The retest checks the known gap; the periodic test also searches for new routes.
Those who follow up on pentest findings in this way turn a report into a management tool. It is not the number of findings that determines value, but what demonstrably works better during the next attempt.
Want to know more about connecting testing and improvement? View Security Improvement or discuss the findings confidentially with Cocoon.
Frequently Asked Questions
Who should own a pentest finding?
The owner of the affected business risk. Facility, HR, or IT can execute a measure, but risk acceptance belongs to someone with decision-making authority.
How quickly should a retest take place?
As soon as the measure has been stably implemented. For a critical risk, a temporary measure may be tested separately earlier; for a structural change, the retest follows completion.
Must every finding be resolved?
No. Mitigation, avoidance, transfer, or conscious acceptance are possible choices. However, the rationale and evidence must be visible.