Week 13 — Report and recommendations

Learning objectives

• Structure a report read by different audiences: executive, technical team, audit.
• Write reproducible findings and actionable recommendations.
• Prioritize based on business impact, not just on CVSS.

Reference structure

1. Executive summary — 1 to 2 pages, no jargon, with the conclusion up front.
2. Scope and methodology — RoE recap, testing windows, tools used.
3. Overview — heatmap of findings, overall posture indicator.
4. Detailed findings — one per vulnerability, in a consistent template.
5. Prioritized recommendations — grouped by theme (identity, network, application, cloud).
6. Appendices — logs, requests, screenshots.

Finding template

Every finding follows exactly the same structure. Readability comes from repetition.

• Short title — action + surface, e.g. "SQL injection on /api/search".
• Severity — P1 to P4, with justification (real impact, not raw score).
• Context — what the target normally does, in one sentence.
• Evidence — request sent, response observed, dated screenshot.
• Business impact — what an attacker gains concretely.
• Remediation — precise action, tested if possible, estimated effort.
• References — CWE, CVE, OWASP, client documents.

What makes a report professional

• One remediation per finding. Without a recommendation, it is not a report, it is a list.
• Reproducible evidence. A screenshot is not enough: give the curl request or the step-by-step.
• A defensible ranking. The client must be able to present your P1 to their executive team and be understood.
• No implicit threats. We document; we do not scare to sell.

Lab 3 kick-off

Final deliverable, due in week 14:

• A complete PDF report (20 to 30 pages), on a supplied simulated engagement.
• At least six findings, including two P1, two P2, two P3+.
• A remediation plan at three months, six months, twelve months.