How do you write a pen-test report that gets paid?

Audience-tailored sections: (1) Executive summary — 1 page, business risk + key findings + recommendations. CXOs read only this. (2) Methodology — scope, tools used, time spent. (3) Findings list — sorted by severity (Critical → High → Med → Low → Info). (4) Per-finding sections — title, CVSS score, business impact, technical detail, screenshots/HTTP evidence, full reproduction steps, remediation guidance. (5) Appendices — full raw scan output, supporting evidence. Tone: factual, never accusatory. Always provide remediation alongside finding. Bug bounty reports often rejected for: insufficient impact explanation, missing repro steps, hostile tone toward vendor.