If you need additional assistance independently verifying the pentest report, please contact your TAM or open a support case at .

After full investigation, for any issues that are determined to be software security vulnerabilities, file a report for each vulnerability with MSRC via the Researcher Portal.

Separate the report into individual issues and contact your Microsoft Technical Account Manager (TAM) and product specific support.

Conduct internal verification of issues listed in the pentest report.

The following are the steps for handling a pentest report: It is a best practice to manually verify the issue reported first with the assistance of Microsoft Security Fundamentals and Microsoft Cybersecurity Reference Architecture.

Often pentest reported issues are related to software not being patched with the most current update. In addition, many issues are configuration related rather than a software vulnerability. Pentests from scanners frequently produce false positives which do not constitute a security risk.

Impact of the issue, including how an attacker could exploit the issue.

Step-by-step instructions to reproduce the issue on a fresh install.

Any special configuration required to reproduce the issue.

Service packs, security updates, or other updates for the product you have installed.

Product and version that contains the bug, or URL if for an online service.

Type of issue (buffer overflow, SQL injection, cross-site scripting, etc.).

If the report contains a novel security vulnerability, the Customer Support Services team can help connect you with MSRC or you can report that directly. Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue. If the vulnerability you are reporting is from a penetration test, please work through your Microsoft Customer Support Services team who can help interpret the report and suggest remediations.

If you believe you have found a security vulnerability that meets Microsoft's definition of a security vulnerability, please submit the report to MSRC at. If you discovered a vulnerability while doing work for another entity (such as during a pentesting engagement), please read the 'I need to validate my pentest report' section and click here for additional info. Note: the guidance below assumes that you are doing research on your own behalf.

Microsoft security code not sending