A penetration tester should most likely include metrics and measures in a report at the end of an assessment.
Metrics and measures provide quantitative data that helps in understanding the extent and impact of vulnerabilities found during the assessment. They offer a clear and objective way to convey the results and the effectiveness of the security controls in place. This data-driven approach aids in prioritizing remediation efforts, benchmarking against industry standards, and demonstrating improvements over time.
References:
* OWASP Penetration Testing Methodologies
* NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment