1. Three types of reports:
   - Executive report
   - Management report
   - Technical report
2. The Risk Matrix quantifies and categorizes all the discovered vulnerabilities, identifies the resources potentially affected, and lists the discoveries, references, and recommendations in a shorthand format.
3. A Vulnerability Map provides a list of discovered vulnerabilities found in the target infrastructure, each of which should be easily matched to the resource identifier (for example, the IP address and target name).
4. An Exploits map provides a list of the successfully checked and verified exploits that worked against the target.

5. A testing methodology should contain enough details to help management understand the penetration-testing life cycle.
6. Client-side or social-engineering attacks can be reduced by training staff members in the latest countermeasures.