The executive report, a type of assessment report, is shorter and more concise, and points out a high-level view of the penetration testing output from a business strategy perspective. The report is prepared for C-level executives within a target organization (the CEO, CTO, CIO, and so on). It must be populated with some basic elements, as follows:

• Project objective: This section defines the mutually agreed criteria for the penetration testing project between you and your client.
• Vulnerability risk classification: This section explains the risk levels (critical, high, medium, low, and informational) used in the report. These levels should be clearly differentiated and should highlight the technical security exposure in terms of severity.
• Executive summary: This section briefly describes the purpose and goal of the penetration testing assignment under the defined methodology. It also highlights the number of vulnerabilities discovered and successfully exploited.
• Statistics: This section details the vulnerabilities discovered in the target network's infrastructure. These can also be drawn in the form of a pie chart, or in any other intuitive format.
• Risk matrix: This section quantifies and categorizes all the established vulnerabilities, identifies the resources potentially affected, and lists the discoveries, references, and recommendations in a shorthand format.

It is always an ideal approach to be creative and expressive while preparing an executive report and to keep in mind that you are not required to reflect upon the technical grounds of your assessment results, but rather give factual information processed from those results. The overall size of the report should be from two to four pages. Please refer to the Further reading section at the end of this chapter for sample reports.