July 2026: Handing Over the Report, With a Receipt

There is an odd moment at the end of most penetration tests. Weeks of careful, logged, reviewed work produce a document that describes how to break into an organization, and then that document leaves as an email attachment. After that, nobody really knows where it goes.

July was about that moment.

Deliverables

Our main story this month was Deliverables and Controlled Release in Neuron (opens in a new tab). It gives the final files of an engagement a proper home: the report, but also attestation letters, scoping documents, memos and presentations.

A deliverable starts as a draft and is published to the Delivery Portal when it is ready, where the client sees it beside the findings and briefs for their engagement. Every view and download is logged. When a corrected report goes out, the new version replaces the old one in the portal, and the earlier copy is withdrawn rather than left lying around.

Signing before downloading

Some clients need more than a link. Under Controlled Release, a named recipient has to read and accept the firm’s handling statement, and type their name, before the file will download. Each signature produces a receipt recording who signed, what they agreed to, when, from where, and a fingerprint of the exact document.

PDFs downloaded from the portal are also stamped with the recipient’s identity at the moment of download, so if a copy ever appears somewhere it should not, it can be traced back. The stored original is never changed.

We think of this as the same principle that runs through the QA work earlier in the year, applied to the last step. Review proves the content is right. Controlled Release proves it reached the right people, on agreed terms.

A better portal to deliver into

Deliverables only work if the portal is somewhere clients want to go. Alongside them, the Delivery Portal gained a clearer overview of each engagement, with the severity mix, how findings have accumulated over time, remediation progress and the schedule of assessments and retests. The Delivery Portal page (opens in a new tab) gives a quick tour.

Meanwhile, in the attack graph

Not everything this month was about the end of an engagement. On the Active Directory side, we kept moving more of the analysis into each engagement’s own graph. Testers can now work through their library of saved graph queries against a dataset, keep track of which ones have been reviewed, and send any interesting set of objects straight into the graph view. It is the kind of bookkeeping that usually happens in a separate notebook, and now it sits with the data. The AD attack paths spotlight (opens in a new tab) covers the per-engagement model it builds on.

Looking back at the month

Handover is rarely anyone’s favorite part of the job, and it rarely gets attention from tooling. That is exactly why it was worth a month. For clients with strict handling requirements, being able to show who received a report, which version, and on what terms is often what they need before they can work with a provider at all.

The full product write-up is on neuron.ws/news (opens in a new tab). For a walkthrough of Deliverables and the portal, book a demo (opens in a new tab).