The email from your client's procurement team is one line long: "Please share your most recent penetration test attestation." You have a report. You are fairly sure that is what they mean. It usually is not. They want one page, signed, and most Pakistani software houses have never been asked for it until the day a contract depends on it.
This post explains that page: what a letter of attestation is, what it says line by line, who reads it and what each reader is checking, what it deliberately leaves out, and how to tell a strong one from the marketing kind. It is the document that turns a pentest from an internal exercise into evidence a third party will accept, and it is included with every report we issue.
What a Letter of Attestation Is, and What It Is Not
A letter of attestation is a one-page signed statement on the testing firm's letterhead. It says that an independent penetration test was performed on a defined scope, between defined dates, against a stated methodology, by a named tester, and it summarises the outcome and the remediation status at the date of signing. It is addressed to whoever needs to rely on it, which is usually not you. It is your client, their auditor or your investor.
Three things it is not, because all three get claimed.
- It is not a certification. No body certifies an application as secure, and a letter that says "certified secure" was written by sales. The letter attests that work was done and what was found; it does not bless the product.
- It is not the report. The report is thirty to sixty pages of findings, evidence and fixes. The letter contains none of that, by design, which is what makes it shareable.
- It is not a guarantee. It describes a point in time and a scope. Deploy a new feature the following week and the letter still describes the week before.
What It Says, Line by Line
Letters vary in wording but not in structure. A complete one has eight blocks, and if any are missing the reader will ask for them. Here is ours, with the client details removed.
- Issuer. VAPT.PK letterhead with address and contact details, so the reader can verify the letter came from us.
- Addressee and subject. Either the named client or "to whom it may concern", and a subject line of the form: Letter of Attestation, penetration test of [product] for [company].
- Statement of engagement and scope. "At the request of [company], VAPT.PK performed an independent penetration test of [application names, URLs, APIs and environments] between [start date] and [end date]." The scope is listed, not summarised, because an auditor will compare it against what the client told them was tested.
- Methodology. Manual-first testing aligned with the OWASP Testing Guide and the OWASP API Top 10, following PTES phases, performed grey box with credentials for the listed roles. Whatever the vendor did, it has to be named here.
- Tester. The name of the person who did the testing, with their credentials. A company name alone is not enough for most vendor-risk teams.
- Outcome and remediation status. Counts of findings by severity, how many were remediated and verified on a re-test of a stated date, and what remains open with its severity. An honest letter names the open mediums; a weak one goes quiet here.
- Limitations. That the test is point in time, bounded by the scope listed, and that no test can prove the absence of vulnerabilities. Readers who know the field expect this paragraph and distrust letters without it.
- Signature, date and reference. Signed by the tester or the firm's principal, dated, and carrying a reference number that matches the full report, so the two can be connected if anyone asks.
What It Proves to Each Reader
Three different people read this page, and they are checking three different things.
Your client's procurement or vendor-risk team wants to know that someone independent of your developers tested the product, when, and whether anything serious is still open. They are running the seven-question checklist we laid out in what your US client wants from a VAPT report, and the letter answers five of the seven on its own. For most contracts this page is the only piece of the engagement the client ever opens.
A SOC 2 or ISO 27001 auditor wants evidence for a control: that technical vulnerabilities are identified and managed, and that an independent assessment of the in-scope system happened inside the audit period. The auditor will insist on a name, a date, a signature and a scope, and will reject a letter without them. The full report goes in the evidence folder too, but the letter is the page the auditor cites. The rest of what goes in that folder is covered in what a SOC 2-ready pentest report contains.
Your own board or an investor doing due diligence wants a yes-or-no answer to "has this been tested and fixed", with a date. They will not read findings. One page with counts and a remediation line is exactly the right size.
What It Leaves Out, and Why That Makes It Safe to Share
The letter contains no finding titles, no vulnerable endpoints, no exploitation steps, no screenshots and no request and response pairs. This is deliberate. The full report, until every finding is fixed, is a map of how to attack you, which is why it goes out only under NDA and often only as an executive summary. The letter carries nothing an attacker could use, so it can go to anyone who asks: attached to an RFP response, posted in a trust portal, forwarded by your client to their own customers.
The practical consequence is that you should keep the two documents apart in your own filing. When procurement asks for "the attestation", send the letter. When a security team asks for "the report", ask for an NDA first and send the executive summary, with the full report to follow if they insist. Sending the full report in reply to a request for the letter is the most common over-share we see.
Report, Letter, Sign-off: Which Document Goes Where
| Document | What it contains | Who receives it | When |
|---|---|---|---|
| Full report | Every finding with CVSS score, proof of concept, impact and fix | Your engineers; a client's security team under NDA | At delivery, re-issued after the re-test with closed status |
| Executive summary | One paragraph on scope and dates plus counts by severity | Client CISO, your leadership | With the report |
| Letter of attestation | Scope, dates, methodology, tester, outcome and remediation status | Procurement, auditors, investors, anyone who asks | With the report, re-issued after the re-test; interim letter on request |
| Sign-off letter | Confirmation that the re-test closed the agreed findings | You, for your own records | End of the engagement |
The version of the letter to send is the one re-issued after the re-test, because it describes the product your client is about to use rather than the one you had before the fixes. If a client needs something sooner, an interim letter can state the testing dates and that remediation is in progress; we can usually have one in a client's inbox within seven to ten working days of kickoff, with the full report following.
Red Flags in a Weak Letter
If you are the buyer, and a vendor hands you a letter, check it against this list. If you are the one receiving a letter from a supplier, the same list applies.
- No named tester, only a company name. You cannot verify a company's skill; you can look up a person.
- No testing window, or a single date with no start and end.
- Scope described as "the website" or "the platform" with no URLs, applications or environments listed.
- Issued before any re-test, with no mention of what was found or what remains open.
- "Certified secure", "hacker-proof", "100 percent secure" or any wording that promises an absence of vulnerabilities.
- No methodology, or "proprietary methodology" in place of one.
- No report reference. A letter that cannot be connected to a report cannot be checked.
- Signed by a sales title rather than the tester or the firm's principal.
The quickest test is to ask for the matching report's executive summary. If the vendor cannot produce a summary whose scope and dates match the letter, the letter is marketing. The wider list of questions to put to a vendor before signing is in how to choose a penetration testing company in Pakistan.
How and When to Ask for One
Ask on the scoping call, and say who will read it. A SOC 2 auditor needs the letter dated inside the audit period, so the testing window has to land there too. A client onboarding you usually wants a letter dated within the last twelve months. An investor wants whatever is current. Each of those changes when the test should be scheduled, which is why it is one of the questions we ask before quoting.
At VAPT.PK the letter is part of the engagement, not an extra, and it sits inside the price alongside the report and the re-test; see penetration testing cost in Pakistan for what else is included. We issue it with the report and re-issue it after the re-test to reflect the post-remediation state. If you need it addressed to a specific party or dated for a specific window, say so at scoping and it is done the same way. The service details are on the security audit and reporting page, and the FAQ covers what auditors usually accept.
Frequently Asked Questions
How long is a letter of attestation valid?
There is no expiry printed on it, but the convention your clients and auditors apply is twelve months, and most will not accept a letter older than that. Test again after any major change to authentication, payments or architecture and get a fresh letter, whatever the calendar says.
Can one letter cover several products?
One letter covers one scope. If several products were tested in one engagement, the letter lists each of them explicitly. If a client only needs assurance about one product, ask for a letter scoped to it rather than sending one that lists everything.
Can we share it publicly?
Yes. That is what it is for. Many companies put it in a trust portal or send it with every proposal. Keep the full report under NDA and share the letter freely.
What if findings are still open?
The letter says so. An honest letter states what remains open, at what severity, and that remediation is tracked, and an experienced reader prefers that to a letter that hides it. Open criticals or highs will usually hold up a contract until a re-test closes them, so fix those first and ask for the letter to be re-issued.
Is this the same as a SOC 2 attestation?
No. A SOC 2 attestation is an auditor's opinion on your controls over a period, and a pentest letter is one piece of evidence that feeds into it. The two get confused constantly; SOC 2 vs ISO 27001 vs a pentest untangles which one your client is actually asking for.
The letter of attestation is the smallest document a pentest produces and the one that travels furthest. One page, eight blocks, signed and dated, with a reference back to the work behind it. If a vendor's letter has all eight, the engagement behind it was probably real. If it does not, ask why before you send it to anyone.
Need a letter your client's auditor will accept, dated inside their window? Tell us who is asking and when, and we will scope the test to produce it.