Now, moving towards best practice as opposed to must‑have properties.
The report should be written in the past tense.
The reason for this is that we're describing things that happened during
the test, which was in the past. Since the test finished,
any number of things could've changed, completely
altering how secure the environment is.
The report is intended to be a point‑in‑time look at security, and that
point in time was in the past. Wording should reflect this.
As a simple example, a port scan on 192.168.88.18 shows port 445 is open.
Should instead be port 445 was open.
It was true at the time it was tested.
Wording should therefore reflect this.
Business reports tend to avoid personal pronouns. That means avoiding direct
references to people involved in the test. Other than the section that names
the test team, we never talk about them directly.
Words like I, we, you, he, she, us are all words that
aren't used because they refer to people.
So, if we wanted to say we found a vulnerability, that includes
the personal pronoun we, so we don't use it.
We could also try the team found a vulnerability, but then
we're still referring to a group of people,
which is the team. Removing personal pronouns, we would
end up with a vulnerability was found.
It comes across as much more professional.