Pen Test Findings That Survive Three Quarters: Closing the Loop

The penetration test report lands, gets one serious meeting, and produces a burst of fixes. Then the quarter turns, priorities shift, and a third of the findings quietly roll into next year's report - where the testers politely list them again.

Findings that survive three quarters are not a testing problem. They are a closure problem: no owner, no verification, and no consequence for aging. The test did its job. The follow-through system did not.

Closing the loop takes a register, a retest discipline, and one number an executive watches: aging.

TLDR

• Every finding gets an owner, a due date and defined closure evidence.

• Closure means verified, not 'the ticket says done.'

• Watch aging: a finding open three quarters is an accepted risk, admit it or fix it.

• Expect repeats; a finding that returns yearly points at a root cause, not a task.

• Report closure rate and aging to whoever funds the fixes.

Why findings linger

Findings die in the gap between the security team that received them and the engineering or IT teams that must fix them. The finding arrives as a report excerpt without a ticket, the ticket competes with feature work, and six months later nobody remembers what 'done' was supposed to look like.

Severity labels make it worse. Medium findings are real weaknesses with real exploit paths, but they queue behind everything urgent. Three quarters later, the medium is still there - a little older, no less open.

Run a findings register, not a report archive

Move every finding out of the PDF and into a register the day the report arrives: owner, due date, and the evidence that will prove closure. The register is a living list; the report is a snapshot that ages the day it is printed.

This fictional example shows a register excerpt. It is an illustration, not a real record.

Finding	Owner	Due	Closure evidence	Status
Exposed staging admin panel	Platform lead	Aug 15	Retest shows closed	In progress
Weak password policy on legacy app	IT lead	Sep 1	Config export	In progress
Unpatched VPN appliance	Network lead	Overdue	Retest + patch record	Escalated

Closure evidence matters. 'The ticket says done' is how findings return. A retest, a configuration export, or a screenshot of the fix is how they stay gone.

Manage the aging number

The metric that changes behavior is aging: how many findings are past due, and by how much. A finding that survives three quarters has been accepted in practice - so make that acceptance explicit, with a named risk owner and a review date, or fund the fix.

Escalate by age, not just severity. A nine-month-old medium tells the executive something a fresh high does not: the machine for turning findings into fixes is not working.

When the same finding returns

A finding that reappears in consecutive tests is a signal about root cause: a build process that reintroduces the weakness, a team without capacity, or a system that should be retired instead of patched again.

Treat repeats as a different conversation. The question stops being 'who will fix this finding' and becomes 'what makes this finding keep coming back.' That answer is usually a process or a budget line, and it belongs one level up.

The related discussion of measuring program effectiveness is worth your time alongside this one.

Frequently asked questions

How fast should findings close?

Common targets are weeks for critical, a quarter for high, and a defined plan for the rest. The exact numbers matter less than having them, assigning owners, and escalating what slips.

Who should see the aging report?

The executive who funds the fixes - usually the CTO, CIO or COO - and the board committee in summary form. Aging is a resource and priority signal, and it should reach the people who control both.

Should we test again before closing old findings?

Only with a reason. Testing an environment full of known open findings buys you a reprint. Close or consciously accept the backlog first, then spend the next test on new ground.

A Defensible Next Step

Pull last year's penetration test report and check each finding's status today. The ones still open need owners, dates and evidence - or a signed acceptance. Either way, the next report should not list them again. Book a Decision-Clarity Call if you want a closure register template.