A big company, who wanted to test their security infrastructure, wants to hire elite pen testers like you. During the interview, they asked you to show sample reports from previous penetration tests.

Signing an NDA with the new company does not override the existing confidentiality obligations owed to the original client whose data appears in the report.

Sharing full, unredacted reports is a severe confidentiality breach that exposes prior clients' vulnerabilities and would violate any NDA or engagement contract signed with those clients.

Prior penetration test reports contain sensitive details about a client's vulnerabilities, architecture, and security gaps, all of which are covered under confidentiality agreements with that client. Declining to share protects those clients' interests, while offering professional references allows the prospective employer to verify competence without exposing confidential data.

Even redacted reports may retain enough detail (network diagrams, vulnerability classes, findings structure) to expose sensitive information about the prior client's environment.