Strategic Guidance – Getting The Most From Your Pen Test Report

It’s Q4 and pen test reports are piling up. Most companies scan for critical findings, patch them, and move on. But those medium and low-risk findings everyone ignores? They’re revealing where your security posture is quietly deteriorating. Gary Blosser, our vCISO and Principal Security Architect, shows you how to extract real value from every section…

Nov 4, 2025

—

marketing@torchlight.io

in Awareness

We’re in the middle of pen testing season. Q4 is when most organizations schedule penetration testing for year-end audits, cyber insurance renewals, and compliance requirements.

Everyone knows the value and risk of the critical and high-risk findings, but what about the others? What value can be found there?

MEDIUM FINDINGS ARE MATURITY INDICATORS

Most organizations only focus on critical and high findings. But medium findings often reveal more about your security posture, a sudden surge of these findings can indicate the security program is starting to falter.

Why They Matter:

Patterns reveal process problems
One medium finding? Fix it. Twelve medium findings about patch management? You have a process problem.

Chained vulnerabilities
Individually medium, combined they’re critical. Attackers chain vulnerabilities together.

Cultural indicators
Medium findings reveal outdated software, weak policies, and missing controls. These lead to breaches.

What to look for:

Patterns across systems
Age of vulnerabilities
Easy fixes you’re ignoring

READ THE LOW-RISK FINDINGS

Low-risk and Informational findings aren’t vulnerabilities that need to be fixed. They’re observations about your security practices.

Most people skip them.

Don’t.

Just because the open network share anyone can access appeared to be benign to the tester, it may not be. It may just be that the tester could not identify those files as critical company secrets.

Common Examples

No security training program
Default configurations in production
Limited logging on critical systems

None are exploitable now, but when something happens, they make life easier for the attacker.

Ask: “If we don’t address this, what happens in 6 to 12 months?” and “If a malicious actor finds this, is that ok?”

That’s your real risk.

THE DIFFERENCE: REPORT DELIVERY VS. STRATEGIC GUIDANCE

Here’s where most pen testing falls short: you get a report and you’re on your own.

Report Delivery Approach

Test completed. Report delivered. Invoice sent. Done.

You’re left figuring out:

What do we fix first?
How do we fix it?
What does this mean for our audit?
How do we explain this to the board?

Strategic Guidance Approach

Test completed. Report delivered. Then we walk you through it.

We help you:

Understand what findings mean for your specific environment
Prioritize based on your risk profile and compliance requirements
Translate technical findings into language your board understands
Build a remediation roadmap

The test is the same. What you do with the results makes all the difference.

Gary Blosser – vCISO & Principal Security Architect

Get Strategic Guidance, Not Just a Report

When you work with TorchLight for penetration testing, you get more than findings. You get a security partner who helps you understand what matters and what to do next.

Learn About Our Pen Testing Services