Most organisations we meet have had a penetration test. Far fewer have fixed what it found.
The report is not the deliverable
A findings report is an input to a remediation programme, not the end of one. If your test ends when the PDF arrives, you have bought a snapshot of your weaknesses and nothing else.
Three things that make findings close
1. Prioritise by exploitability, not by CVSS alone
A medium-severity issue reachable from the internet without credentials matters more than a high-severity one requiring domain admin. Ask your tester to rank by realistic attack path.
2. Cost the remediation
"Implement network segmentation" is not an action. "Move the six payment-processing hosts into their own VLAN, estimated four engineer-days" is.
3. Book the retest before the test
A retest date in the calendar changes behaviour more than any amount of urgency in an executive summary.
If nobody is accountable for closing a finding by a date, it will not close.
What good looks like
The engagements that work have a named owner per finding, a target date, and a retest booked. Everything else is theatre.