April 2026: The Days Between Testing and Delivery

Ask a pentest lead where an engagement loses time and the answer is rarely the testing. It is the stretch afterwards, when findings are written, checked, rewritten and checked again before anything reaches the client. That stretch was our focus for April.

Review, inside the finding

The main story of the month was our write-up of track changes, inline comments and the review queue in Neuron (opens in a new tab). It describes how review now happens on the finding itself, rather than in an email thread or a copy of the report someone has to merge back.

A reviewer’s edits are recorded as they make them, so the author can see exactly what changed and accept or reject each one. Comments attach to the precise sentence they are about. Replies stay in the same thread, and resolved points get out of the way. The part we think matters most is the approval gate: a finding cannot be approved while any edit is undecided or any comment is open. Loose ends get dealt with before sign-off, not discovered afterwards.

The review queue then gives each reviewer a single place to work from, split into what needs their review, what needs their approval, and what they are waiting on from others. Items change color as they age, so a lead can tell at a glance whether review is keeping up.

The QA process around it

Track changes sits inside a larger idea: that quality assurance should be part of how an engagement runs, not a scramble the night before delivery. Early in the month we published a spotlight on the Neuron QA pipeline (opens in a new tab), which covers the path every finding takes from draft to approval and how teams choose between a two-step and a three-step review.

Smaller firms often want the reviewer to have the final word. Teams with compliance obligations usually want a separate approver. Both are supported, and each engagement has its own reviewers and approvers.

AI that stays on site

The other theme of April was AI, and specifically where it runs. Penetration test findings describe how to break into a client’s environment. Many security teams cannot send that material to a third party’s cloud model, whatever the productivity gain.

Our AI reporting spotlight (opens in a new tab) explains the alternative we chose: Neuron AI runs on the customer’s own hardware, and every inference stays inside their network. It drafts the engagement-specific parts of a finding and leaves approved library language alone, which brings it back to the theme of the month. Less time writing boilerplate, more time reviewing what is actually new.

We closed April with a spotlight on the Findings Library, which ties these pieces together: reviewed language the team trusts, reused across engagements, with AI filling only the gaps.

The common thread

Every piece of work this month pointed at the same goal. When a report is ready, a team should be able to say who reviewed each finding, what they changed, and that nothing was left unresolved. That is a higher bar than most reporting processes set, and it is the one we want Neuron to make routine.

For the full product stories, visit neuron.ws/news (opens in a new tab). To see review in Neuron with your own team’s workflow in mind, request a demo (opens in a new tab).