A penetration test is only as good as the report it produces. A framework for what truly effective security reporting looks like.