Pentest management: from scoping to retest
Last updated by Rachael Carder on 2026-10-15
Pentest management is the work around the test itself: scoping the engagement, scheduling testers, tracking coverage, turning findings into the client's report, reviewing it, and following the fixes to a retest.
When three or more testers share that work, most of it can still run on email and a calendar. The report is where it breaks.
Key takeaways
- Scoping, scheduling and remediation can run on general tools for a long time. A growing team loses its days in the report.
- The report stalls in three places: a different format for every client, wording that drifts between testers, and one senior's review queue.
- Judge a pentest management platform on those three first, then on where it keeps your clients' findings.
Who this guide is for
Read this if you run delivery at a pentest consultancy of three or more testers, or you're the tester who keeps the team's tracker and report template working.
Skip this if you test alone or in a pair. A tidy folder and a good Word template will do, and the free Dradis Community Edition covers one project at a time if you want a tool anyway.
Skip it too if your business is high-volume vulnerability scanning: a vulnerability management platform fits that work better.
The five stages of a pentest engagement
Every engagement runs through the same five stages. Team size changes how many people touch each one, and how many hand-offs sit between them.
1. Scoping and kickoff
You agree on the targets, testing windows, rules of engagement, contacts and the report format the client expects. Credentials, IP ranges and approvals need to arrive before day one. As the team grows, the answers come back across several email threads, and the tester who starts on Monday finds half of them on Tuesday.
2. Scheduling
You assign testers to engagements without double-booking the one person who knows mobile. A shared calendar works until nobody can see who is free next month without asking around.
3. Testing and coverage
Testers work through the methodology, run scanners, take notes and capture evidence. With more testers, each one keeps their own copy of the checklist, scanner output needs cleaning and rewording before it goes near a report, and two testers rate the same finding two different ways. The client sees that difference in the report.
4. Reporting and QA
Findings become the deliverable, in the format the client asked for, and a senior reviews it before it goes out. This is the stage that breaks first, because every tester's work meets in one document, and one reviewer signs it off against a date the client is already expecting.
Findings get copied from old reports into Word and formatted by hand. Every report waits in one review queue, so Friday becomes report day, and someone asks "did you get the new version?" Each bank or government client sends its own format, so the team keeps a Word template for every one of them and fixes it by hand when the client changes it.
5. Remediation and retest
The client fixes what you found, you verify the fixes, and someone tracks which findings are still open. Without a shared status, the retest starts with working out what changed since the report.
What to ask of a pentest management platform
Every platform in this category imports scanner output and exports a report. Ask these questions in this order: the first three are about the report. We build Dradis, so the answers below are ours.
1. Who builds a template for each client's format, and who updates it when the format changes? If the answer is your team, a tester squeezes it in between engagements. On every paid Dradis plan, we build your templates from a sample of the report you deliver today and keep them up to date, at no extra cost. We have built and maintained over 1,182 templates since 2010. One project's findings export into any of them, so a new client format means one new template, not rewritten findings. Before you decide, send us a sample report, and we tell you what the template will match exactly and what needs a Word macro.
2. Do two testers write the same finding the same way? In Dradis, they don't have to. The client gets your team's best write-up of each finding, from the shared Issue Library. The Rules Engine merges duplicates and swaps scanner wording for those write-ups, from any of the 47 supported tools. Everyone scores them with the same CVSSv4 and DREAD calculators, too.
3. Can review start while testing is still running? In Dradis, every finding, piece of evidence and content block, such as the executive summary, has its own QA state, so nothing waits for the whole report. Reviewers go through them PR-style: inline comments, side-by-side diffs, threads resolved as the fixes arrive. Your senior reviews findings as they come in during the week, instead of a whole report on Friday.
4. Where do your clients' findings live? A cloud platform keeps them on the vendor's servers, and some clients set rules on where their findings may be stored. Dradis runs only on infrastructure you control: a server in your rack, your own cloud account, or an air-gapped network, with the same features in each. There is no hosted Dradis.
5. What will your team run itself? A platform on your own servers means your team installs, backs up and updates it, the same way you run the rest of your lab. That is the cost of keeping custody of the findings.
"Reporting went from 1-2 days to half a day. Now we have way more time to spend on the fun things."
Dradis also covers the stages around the report. Questionnaires collect kickoff answers through the client portal, and the Project Scheduler shows every project's dates on a shared calendar. The Remediation Tracker and the Jira, ServiceNow and Azure DevOps integrations come with the Remediate plan, which is built for internal security teams.
See how the Dradis pentest management platform handles each stage.
Frequently asked questions
How is pentest management different from vulnerability management?
Vulnerability management is continuous: scan every system, rank what you find, patch, and repeat. Pentest management is built around engagements: a scoped test, run by people, for a client or an internal team, that ends in a report and a retest. The two meet at remediation tracking.
Can you manage pentests in Jira or Excel?
Up to a point. Jira tracks tasks and tickets, and a spreadsheet tracks findings. Neither turns findings into the client's report or keeps two testers' wording the same, which is why teams usually outgrow them at the reporting stage.
Bring your report formats to the demo
Book a 15-minute call. Show us what you deliver and how your team reviews it, and we'll show you the same thing in Dradis.
About the Author
Rachael Carder. Since 2015 Rachael has been guiding cybersecurity teams to do more with less and reduce their overhead.