We analyzed 394 public penetration test reports — page counts, section structure, and the PDF toolchains behind them. What the industry's core deliverable actually looks like.