Reporting // Communicate the Risk
Reporting
Evidence structure, severity language and remediation framing for assessments that need to be understood by more than the tester.
frameworkselected referencestechnical reference map
Core principles
- State the tested surface, assumptions, authorisation and time window clearly.
- Write each finding so technical teams can reproduce it without guessing.
- Explain exploitability and business impact together instead of treating them as separate stories.
- Offer remediation paths that are operationally realistic and prioritised.
- Document retest boundaries so unresolved exposure stays visible.
Selected public references
