Who owns a penetration test report, and can the testing firm license it?

Can a penetration testing firm license its reports?

Not the client-specific ones, in most cases. A pentest report describes a named client's systems and weaknesses, and engagement letters typically treat it as the client's confidential information. What the firm may own is a separate layer: its methodology, test plans, internal tooling documentation and anonymized finding taxonomies.

So the honest answer to an owner who asks "do we own our reports?" is "probably not the reports, possibly the know-how behind them". Whether a given firm can license anything depends on its contracts, which SourceX reviews with the company. This is general information, not legal, tax or financial advice.

Two columns to use with the owner

Draw this on a call. It turns a vague worry about confidentiality into a sorting exercise.

The pentest contract's intellectual property and confidentiality clauses decide where an item falls. If the firm's reusable material is mixed with client data, the rights review decides what, if anything, can be separated.

What the contract clauses usually decide

Ask the owner for the master services agreement and a typical statement of work, then check four things:

• Deliverable ownership: does the client own the report on delivery, or only receive a license to use it?
• Confidentiality term: does it expire, and does it cover findings after anonymization?
• Residual knowledge: does the contract let the firm reuse general skills and techniques learned during the work?
• Firm-owned tooling: are scripts, payloads and methods carved out as the firm's background material?

A firm with a lawyer-reviewed template and consistent terms across clients is a far easier conversation than one with different informal terms for each account.

How to respond when an owner says the reports are all confidential

Acknowledge it first; the owner is right about client findings.

Then ask three questions: how long has the firm kept methodology and quality records, which systems hold them (wiki, ticketing, document repository), and who could export them. The company fit checker gives a preliminary, non-binding screen without contact details.

What if the concern is valid

Sometimes it is. Park the firm when any of these is true:

• The firm has under 50 full-time employees at peak, which is common for boutiques. The baseline on who qualifies is 50+ full-time employees at peak (contractors excluded).
• Its only substantial archive is client reports with no carve-outs.
• Government or regulated clients restrict all engagement material.
• Nobody can export the internal wiki or ticketing history.
• The owner will not consider an exclusive license.

Larger security and IT services groups are a different case. A managed security provider with several hundred staff and years of ticketing, runbooks and incident records may qualify, and the same client-versus-firm split applies. For comparison, see how the software agency code ownership question separates client deliverables from agency tooling, and the Phase I environmental report question for a consultant whose reports go to named users.

How the introduction works without touching findings

You make the introduction and give basic fit information only. You never receive, describe or upload any report.

1. Register and share your referral link, or submit the firm through the referral form.
2. SourceX qualifies size, history, data breadth and rights.
3. The firm completes a data inventory by system, with years of history.
4. Price and terms are agreed before buyers review anything.
5. After a signed agreement and the firm's authorization, only agreed material is prepared and delivered.

How partner rewards work

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. Roll-up sponsors can screen several security add-ons using the buy-and-build sectors guide.

Next step

If you know a security firm with real scale and a clear split between client work and its own know-how, register as a partner and make the introduction. Confirm with your own counsel before advising any firm on contract rights.