When sensitive data exposure is discovered during a penetration test, it is vital to immediately communicate this finding to the primary contact or another predetermined emergency contact. This ensures that the organization is aware of the data breach risk and can take swift action to mitigate it before it can be exploited by actual attackers. Communicating lesser findings or deferring to a status report would not convey the urgency of the situation, and waiting until the presentation of findings could result in unnecessary exposure time.