Hire an Editor – Penetration Test Reporting Tips

If you really, honestly, and truly want to take your reports to the next level, hire an editor. This will no doubt seem self-serving since I pay my bills by editing reports and telling people how to write more clearly.

No, the reason I recommend that you hire an editor is that any time we humans write something, we cannot see it clearly. This is not something you can overcome. It is just the way we and our brains work. I know. Any time I write something, I try to have at least two other people read it, and every time I wind up making changes based on the feedback I receive.

The problem about not seeing your own writing clearly doesn’t just apply to blog posts or pentest reports. For example, as I write this, I am tutoring a friend who recently retired from military service and has decided to pursue a college degree. As part of the online class format, he is required to write and share a discussion post with his class every week. One of the things he consistently stumbles over is trying to write things in such a way that someone with no knowledge of a subject he is discussing can follow his arguments and any points he raises along the way. He knows what he is talking about, but most people reading his discussion posts won’t have the same knowledge or experience he has. Helping him wrap his brain around the fact that he needs to provide context for his comments and position statements is… a lot like pulling hen’s teeth.

I run into the exact same issue over and over again with pentesters.

Please understand, the pentesters I get to work with are among the most intelligent people I have ever met. And that is part of the problem. They know their stuff. They know how to find and exploit vulnerabilities in networks, web apps, mobile apps, Active Directory, and so on. And because they are genuine subject matter experts in their respective areas of expertise, it is common for them to take as granted that the people reading their reports have the same, or at least similar, degrees of expertise.

And their readers don’t.

This issue just one of many that an editor can help you address and redress. And if you won’t believe me, believe Stephen King, who plainly states in his book, On Writing, that, “The editor is always right.”[1]

If your editor is worth their consulting fees, they will serve as reality checker, conceptual mirror, and prose polisher. Their job is to ensure that the final product is understandable, has appropriate content, legible images, and generally reflects well on the author’s skill, knowledge, and abilities. An editor will help make sure that common writing/reporting pitfalls are avoided. They will ensure that the report is clearly written, that the content flows smoothly from one section to another, that the voice is appropriate, that the punctuation is well formed, that any brand or tool names are correctly spelled and formatted, and that several dozen other aspects of the report reflect well on you and provide useful information to the people on the receiving end.

No matter how good a writer you may be, a good editor will force you to improve your writing skills, and will help you meet the needs of your clients as effectively as possible. They may also catch flipped bits, typos in your code, and non sequiturs.

If you can’t hire an editor, at the very least have someone else read your work with a critical eye. Ideally, that someone should be a person who writes well, themselves, and who has a passing familiarity with the subject matter. And if you want to put your prose through a more intense acid test, have someone read your work who has NO background or familiarity in the subject. The feedback they give can illuminate significant issues, and the end product will be far better for it.


[1]. King, S. (2020). On writing: A memoir of the craft. Scribner.

Leave a Reply

Your email address will not be published. Required fields are marked *