"Fraud" has specific legal meaning and I think that is beyond the scope of this site. You may want to consult an attorney. And keep copies of what you've written in a secure location if you know others are altering your statements.

Regardless of any potentially fraudulent aspects of this question, I think the bigger elephant in the room is that your bosses would likely throw you under the bus to protect themselves when the pen testing can't be substantiated.

We can't tell you whether it's worth resigning over. That's a judgement call you have to make for yourself..

Calling for opinions, rather than facts, will often get a question closed.

So you changed a document with your name on it to include blatantly false assertions, and you're "confident" this was ethical behavior? Respectfully, that's incoherent. Textbook "superior orders" defense.

Whatever you do, be sure to archive any communication relevant to this in a place your employer can't touch. For example, by forwarding e-mails to your personal e-mail. If shit hits the fan, you might need that evidence, and your employer may lock you out of your company e-mail.

"I was very clear that I thought the sections that were not written by me were not accurate." - You really weren't. You exported a standalone PDF document containing only the director's lies and none of your explanatory annotations. You must have known the PDF would be used to lie to the client. That none of your caveats would be passed on. Better options include refusing to put false statements in a document, or at a minimum putting them in a 'live' doc with clear notes highlighting that the false content is false, and telling the director to PDF it themselves if they want a PDF.

The "best" weasel words for the original assessment would have been "There are no outstanding issues identified through pentesting."

Is that you, Greg?

All I want to know is why you're asking this here AFTER you've done the deed.

"Boss, if they find out the truth, you, as a director, could go to jail. Is it worth spending $40,000 to get a pen test and avoid that?"

It could have been so much easier. Just stay adamant and state that there was no pen testing and if somebody promised that it would be their problem. If not it can surely be done for the client, for a fee.

This is how Grenfell Tower happened. And yes, it's fraud. Your options are (i) resign, (ii) tell the boss that you refuse to take the zoom meeting (see (i)), (iii) tell the client the truth (see (i)), or (iv) dig yourself in deeper by lying to the client face to face. Sorry.

This is beyond workplace.se, you need a lawyer YESTERDAY. Do you want a clean criminal record? Lawyer.

I don’t understand how anyone could possibly think that a boss who asks you to alter a document to contain a downright lie would ever do anything but immediately discard any notes that the document is not truthful. Why on earth did you ever comply with such an obviously fraudulent and immoral request? The only response to that request that would have kept you safe from fraud would have been to refuse to comply and tell your directors that if they want to claim you’ve pentested, they should get a pentest ASAP.

@JanusBahsJacquet these kind of things happen a lot. No need to get on a high horse and insult OP. It can be very difficult to make the right decisions when there is being put a lot of pressure by higher ups on you and/or if your livelihood depends on it. OP is already clearly in a moral dilemma and how he got there is very understandable. The question is what is the right thing to do now.

@seg I don’t disagree, and I didn’t mean to insult the asker; I just don’t understand the thought process. They must at some point have thought along the lines of, “Well, my boss did ask me to deliberately and blatantly lie in this important document for a government-funded potential client, but if I write in an e-mail to him that it’s a lie, I’m sure he’ll make sure the client sees that as well”, and I don’t understand how anyone can avoid seeing how unbelievably unlikely and self-contradictory that is.

What are you going to do when they ask to see the pen test report?

@Darren that is my question too. And what is the Director hoping OP will do? Talk the client out of it? Make up a report out of whole cloth? Get themselves fired?