// REPORTING

Reports a board reads and an engineer fixes from

Two documents per engagement, executive and technical, one methodology.

// FORMATS

Executive vs technical

EXECUTIVE REPORT

For decision makers

Critical 3High 8Medium 12Low 15

Risk score, business impact, remediation roadmap, compliance mapping (ISO/IEC 27001, PCI DSS, CBO).

TECHNICAL REPORT

For engineers

[CRITICAL] SQL injection POST /login (username)
CVSS 3.1: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Evidence: screenshot-04.png, request-04.txt
Fix: parameterised queries; see appendix B
severityvectorevidencefix

Every finding: steps to reproduce, evidence, impact, CVSS vector, remediation, references, retest status.

// CONTENTS

What every report includes

01

Executive summary

Plain-language risk narrative.

02

Technical findings

Reproducible, evidenced, rated.

03

Risk matrix

Likelihood by impact heat map.

04

Remediation guidance

Prioritised, with effort estimates.

05

Compliance mapping

ISO/IEC 27001, PCI DSS, UAE IA, CBO.

06

Retest validation

Free retest, closure confirmed.

// METHODOLOGY

Methodology

  1. 01

    Risk scale

    Likelihood and impact on a 5 by 5 matrix, expressed as one 0 to 100 risk score per engagement.

  2. 02

    CVSS 3.1

    Every technical finding carries a base score and vector.

  3. 03

    Standards

    ISO/IEC 27001 control references, PCI DSS requirement mapping, regional regulator mapping (CBO, SAMA, UAE IA).

  4. 04

    Delivery and support

    Report walkthrough with your engineers, remediation Q and A for 30 days, free retest within 90.

Want to see one?

We share a redacted sample under NDA.

Request sample report