Penetration Test Certificate: What It Proves and What to Ask For

A penetration test certificate is a short document that proves a security test took place. It names who did the testing, when, and what was covered. It does not prove your systems are secure, and no honest tester will say it does. If a customer, insurer or auditor has asked you for one, this guide explains what to hand over and what to expect.

What is a penetration test certificate?

Strictly speaking, there is no official certificate for passing a pen test. Nobody “passes” one. A tester attacks your systems, writes up what they found, and you fix the problems. What most people call a penetration test certificate is a letter or one-page summary from the testing company, often called a letter of attestation or a letter of assurance.

Packetlabs, a Canadian testing firm, describes a typical letter as listing the organisation tested, the provider, the assessment dates, a high-level scope, the methodology and a categorised summary of findings. It carries a signature on company letterhead.

Think of it as a receipt. It confirms the work was done, but it says very little about how good your security was on the day.

Who asks for a penetration test certificate, and why?

The request usually arrives in one of four places:

• Customer security questionnaires. Larger buyers want evidence that their suppliers test their own systems.
• Procurement and vendor onboarding. A tender may ask for a test within the last 12 months.
• Audits and frameworks. Standards such as ISO 27001 and SOC 2 expect you to show evidence of technical testing.
• Cyber insurance. Some insurers ask whether you test, and how recently.

In each case the asker wants proof without reading a 60-page technical report. That is a fair request. Your full report lists every weakness in your estate, and you should not be emailing it to strangers.

What does a penetration test certificate actually prove?

Less than most people hope. The NCSC, the UK’s national cyber authority, is blunt about this. It says a pen test can only validate that systems are not vulnerable to “known issues” on the day of the test. Tests often happen a year or more apart, so new weaknesses can sit unnoticed in between.

So a good certificate proves three things:

1. An independent party tested the systems named in the scope.
2. The testing happened on the dates shown.
3. The provider followed a stated method.

It does not prove the whole company is secure, and it cannot cover systems outside the scope. Because it says nothing about what changed after the test date, treat it as a snapshot, not a seal of approval.

What should a good certificate include?

If you are the one asking your tester for a letter, check it covers these points:

• Your company name and the tester’s name.
• The test dates, and the date the letter was issued.
• The scope: which applications, networks or cloud accounts were tested, and what was left out.
• The type of test, for example external network, web application or internal network.
• The method used, such as OWASP guidance for web applications.
• A summary of findings by severity, without technical detail.
• Whether serious issues were fixed and retested.
• A named, signed contact at the testing firm.

A vague letter that says only “testing was completed” often fails a procurement review, because buyers read these every week and know what a thin one looks like.

Does the certificate replace the full report?

No. The letter is a summary for outsiders. The report is the working document for you. It contains the evidence, the exploit steps and the fix advice that your engineers need. If you are unsure what that should look like, our guide to what a good penetration test report looks like walks through it.

However, some auditors and large customers will still ask to see the report, or an extract, under a non-disclosure agreement. That is normal. Agree in advance who can see it and how it is shared.

How recent does the certificate need to be?

Most buyers expect a test within the last 12 months. After that, the letter starts to look stale. Release changes also matter. If you rebuilt your main application since the last test, the old letter says little about the new code.

Fixes matter too. A letter that lists open high-risk findings will worry a reader. The better position is to fix the issues and have them checked. Our guide to penetration testing remediation and retesting explains how that works, and a retest letter that shows the problems are closed is far stronger than the first one.

Does CREST accreditation affect how much the certificate is worth?

It can. “Penetration test” is not a protected term, so anyone can sell one. CREST accredits testing companies. It describes accreditation as a recognised mark of quality, professionalism and assurance, and says accredited firms have competent staff, proven methods and strong data protection.

That is an organisation-level signal about the tester, not a guarantee about any single test. A letter from an accredited firm tends to carry more weight with a cautious buyer. The NCSC adds that the quality of a test depends largely on the skills of the people doing it, because testing “cannot be entirely procedural”. Ask who will actually run your test.

How do you get a penetration test certificate?

Ask for it before the test starts. Some firms issue a letter as standard, while others treat it as an extra, so settle it in the scope. Here is a simple order of work:

1. Tell the tester why you need the letter and who will read it.
2. Agree the scope so it covers what your customer cares about, such as the product they buy from you.
3. Run the test and fix the findings.
4. Ask for a retest of the serious issues.
5. Request the letter once the retest is done, so it reflects your fixed position.

If you want a scoped test with a letter your customers will accept, you can see how Aardwolf Security approaches penetration testing or get in touch to talk it through.

Frequently asked questions

Is a penetration test certificate the same as Cyber Essentials?

No. Cyber Essentials is a government-backed scheme that checks basic security controls. A pen test letter confirms that a specific technical test was carried out. Buyers sometimes ask for both.

Can I write my own certificate?

No. The value comes from an independent third party signing it. A self-written letter proves nothing and can damage trust if a customer checks.

Can a failed test still produce a certificate?

Tests are not pass or fail. A letter can report that high-risk issues were found. Most buyers prefer a letter that shows findings were fixed and retested over one that claims everything was perfect.

How long is a certificate valid?

There is no fixed rule. Twelve months is the common expectation, and a major change to your systems can make an earlier letter out of date sooner.

Can I share the letter with several customers?

Usually yes, because it holds no sensitive technical detail. Check the wording with your tester first, and keep the full report private.