Communication and working with developers

Overview

Findings become fixes through clear, constructive communication: translate risk into business impact, calibrate to the audience, and be honest about uncertainty. Work with developers collaboratively and specifically (exact location + concrete fix, respect constraints). Clarify scope early, surface Critical findings immediately, and take good notes.

Why it matters

A finding only reduces risk if the right people understand and fix it. Communicating impact simply, collaborating with developers rather than blaming them, and escalating urgent issues promptly are what make a tester effective and trusted.

Core concepts

Translate risk. Business impact, audience-calibrated, honest about uncertainty. Collaborate. With developers; specific, actionable, respectful of constraints. Hygiene. Clarify scope early, escalate Critical findings immediately, take notes. Throughline. Pentesting is a service to make systems safer.

Lesson

The final professional skill: turning findings into fixes through people. The best report fails if it's adversarial or unclear.

Communicate risk simply

• Translate technical findings into business impact for non-technical stakeholders: "this lets anyone read customer data" — not a CVE string.
• Calibrate to the audience: depth for engineers, outcomes for executives.
• Be precise about uncertainty: distinguish "confirmed exploited" from "likely vulnerable, not confirmed".

Work with developers, not against them

• Collaborative, not adversarial: the goal is a more secure product, shared with the dev team — not to prove they failed. Tone matters.
• Be specific and actionable: point to the exact code/endpoint and the concrete fix; offer to clarify and re-test.
• Respect constraints: developers have deadlines and trade-offs; help prioritize, suggest pragmatic mitigations when a full fix is slow.

Engagement hygiene

• Ask for scope clarification early when anything is ambiguous — don't assume.
• Write clear client emails/updates: status, blockers, and any urgent findings surfaced immediately (don't wait for the final report on a Critical).
• Take good notes throughout — they become the report and protect you.

The throughline

Pentesting is ultimately a service to make systems safer. Technical findings only create value when communicated clearly, scoped honestly, and handed to the people who can fix them — constructively.

Summary

The closing professional skill is communication: convey risk in business terms, work constructively and specifically with developers, clarify scope, escalate urgent findings immediately, and keep good notes — turning findings into fixes, which is the whole point.