How Orange Cyberdefense Modernised Pentest Reporting

Maintaining the same level of quality, consistency and collaboration across every engagement is therefore a must. As the organisation continued to grow, however, it became increasingly clear that the reporting process needed to evolve alongside the business.

The Challenge: Consistency, Collaboration and Maintainability

For years, the team relied on Microsoft Word combined with a custom reporting plugin. While this solution served its initial purpose, it became increasingly difficult to maintain. Templates were complex to manage, reusable security knowledge was spread across previous reports and teams, and collaboration on larger assessments remained constrained by a document-based process.

As different testers and teams worked on assessments, keeping reporting structure, presentation, and reusable content aligned required increasing coordination. Vulnerability knowledge could remain buried in previously delivered reports, while template changes and updates to the custom reporting setup required internal maintenance.

The challenge was no longer simply how to produce a high-quality pentest report; it was how to support a growing assessment operation without allowing reporting, review, and maintenance to create unnecessary overhead.

Collaboration was another limitation. A document-based workflow made it difficult for several testers to contribute efficiently to the same report, creating bottlenecks during larger engagements. Review cycles grew longer, formatting required unnecessary manual effort, and even small changes to the reporting setup could require significant additional work. Review also depended on coordinating document versions, comments, and changes, as well as on creating workarounds for the report that did not directly contribute to the technical assessment itself.

At the same time, the custom plugin solution required ongoing internal attention. What had originally solved a practical reporting problem increasingly became a limitation on how efficiently teams could deliver assessments.

The Decision

Orange Cyberdefense wanted to reduce the time and effort surrounding pentest reporting without compromising the quality of its deliverables.

Moreover, the replacement needed to support multiple testers, reviewers, project managers, and other users contributing to the same assessment, make reusable security knowledge easier to maintain, improve consistency across reports, and reduce the manual work associated with document formatting and reporting.

Self-hosted deployment was also required so sensitive assessment data could remain within infrastructure controlled by Orange Cyberdefense.

Why Security Reporter

With Security Reporter, findings and evidence can be documented directly within the assessment using enriched Markdown that converts directly into the final PDF report. This removes the need for manual document formatting while approved finding templates allow teams to reuse established vulnerability descriptions and remediation guidance.

Multiple testers can contribute to the same assessment, and review can take place within the workflow itself rather than through separate Word versions and email conversations. Full technical and management reports are then generated from the underlying assessment data, helping teams maintain consistency across deliverables and allowing clients to have a direct overview of their reports at any time.

The change was therefore not simply a move from Word to another reporting solution, but a move to a workspace where consistency, collaboration, and reporting could be managed in one place.

The Outcome

With Security Reporter, reporting became part of the assessment workflow rather than a separate document-building exercise at the end.

Moving from document-based reporting to a workflow-driven approach helped Orange Cyberdefense standardise assessment delivery across teams. By using enriched Markdown that converts directly into PDF reports, researchers no longer need to spend time manually formatting documents. According to the team, this saves approximately half a day of work each week.

A centralized finding template database and shared reporting workflow make it easier to maintain common reporting standards across assessments and regions. Teams can build on centrally maintained vulnerability content, helping different teams work from the same templates and produce more consistent reports, while still adapting findings and reports to individual client requirements.

Multiple testers can contribute within the same assessment instead of relying on separate report versions. Review feedback stays closer to the findings themselves, reducing the coordination required to understand what has changed and what still needs attention.

Report customization also became significantly simpler. When one client required a specific set of colours and fonts, Orange Cyberdefense was able to implement the requested appearance in around 20 minutes. Once configured, switching between report themes takes only seconds, making it easier to adapt deliverables to individual client requirements without rebuilding report templates.

The responsiveness of the Security Reporter support team has also been an important part of the experience. During two years of daily use, Orange Cyberdefense encountered two blocking issues related to PDF generation. In each case, the issue was identified within hours, with either a workaround or a hotfix deployed the same day. For a team delivering dozens of pentest reports every week, this level of support helps keep reporting operations moving.

Moving away from the custom Word-based setup also reduced the internal effort required to maintain the previous reporting solution. The need to maintain the previous custom reporting setup was removed, while Orange Cyberdefense could continue managing its own assessment content, configuration and internal workflows.

Together, these changes provide a more scalable foundation for delivering penetration tests without requiring the reporting process around them to become increasingly complex.

Looking Ahead

For Orange Cyberdefense, modernising pentest reporting was not simply about generating reports faster. The broader change was moving from a document-centred reporting process towards a structured assessment workflow in which reusable knowledge, collaboration, review and reporting could be managed more consistently.

The result demonstrates how a secure, self-hosted workspace and reporting platform can help Managed Security Service Providers like Orange Cyberdefense modernise their offensive security workflows. Security Reporter adapts seamlessly to each organization’s unique operational requirements, ensuring that security specialists can dedicate their expertise to the quality and depth of the assessments they deliver.

About Orange Cyberdefense

Orange Cyberdefense France is a leading cybersecurity provider, helping organizations protect their digital assets against evolving cyber threats. With more than 3,300 cybersecurity experts globally, Orange Cyberdefense delivers end-to-end security services across threat intelligence, penetration testing, managed security, incident response, and cybersecurity consulting.

With a strong presence in France and across Europe, Orange Cyberdefense supports organizations throughout the full cybersecurity lifecycle, from identifying and protecting critical assets to detecting and responding to cyber threats.