Executive decision view
Business exposure, attack narrative, priorities, accountable owners, and the decisions required now.
REPORT—STD
A report engineers can act on and assurance teams can trace.
Not a vulnerability list, but a decision record connecting boundaries, attack narrative, evidence, priority, remediation, and verification.
01
Report anatomy
Five layers connect leadership, engineering, and assurance in a shared, traceable record.
Scope and limitations
Exact assets, roles, dates, access, exclusions, blocked work, assumptions, and point-in-time limitations.
Traceable coverage
Named method and version, stable test and control identifiers, applicability, execution state, result, evidence, and limitation.
Reproducible findings
Affected asset, sanitized evidence, reproduction steps, CVSS v4.0 vector, separate business priority, root cause, and validation criteria.
Engineering closure
Tactical fix, strategic control improvement, accountable owner, due date, retest evidence, and residual risk.
02
Finding standard
Every finding includes the affected asset, prerequisites, reproduction steps, sanitized evidence, impact, CVSS score and vector, separate business priority, root cause, remediation, and validation criteria.
Technical severity
The CVSS v4.0 score and vector do not replace business-risk assessment.
Contextual priority
A reasoned treatment decision based on exposure, asset, evidence, and impact.
Evidence provenance
The report distinguishes automated discovery, manual validation, and professional inference.
03
Closure and retest
The closure record compares original and current status, shows verification evidence and residual risk, and states exactly what was not retested.
NEXT DECISION
Open the full sanitized sample report.
The PDF is fully fictional, uses .invalid domains, and contains no client data. It demonstrates decision framing, coverage, evidence, findings, and closure.
Download sample report (PDF)