Report Security Assessment
Overview
Produce a report that lets technical owners reproduce findings and non-specialists understand what matters. Preserve uncertainty, scope limits, and negative results that materially constrain conclusions.
Read references/security-report-shape.md for the required structure.
Workflow
- Fix report identity.
- Record title, client/project, assessment type, dates, version, authors, classification, and distribution.
- State scope and authority.
- List included/excluded targets, environments, accounts/roles, techniques, time windows, constraints, and changes from the approved scope.
- Summarize outcomes plainly.
- Explain what was found, affected assets, practical consequence, urgent actions, and material uncertainty without jargon or panic.
- Describe methodology and coverage.
- Name standards/guidance, tools/versions, manual checks, evidence sources, assumptions, unavailable telemetry, and untested areas.
- Write each finding.
- Include identity, status/confidence, affected assets, prerequisites, evidence/reproduction, impact, exposure, severity/vector if used, remediation, mitigation, and retest steps.
- Keep raw secrets and unnecessary personal data out of the report.
- Record negative results and limitations.
- Build a remediation plan.
- Group immediate containment, near-term fixes, structural hardening, owners, deadlines, and dependencies.
- Verify the report.
- Cross-check evidence links, commands, screenshots, identifiers, redaction, scope, and status.
Output
Return a self-contained report with executive summary, scope, methodology, findings, negative results, limitations, prioritized remediation, and retest plan.
1---2name: report-security-assessment3description: Write a security assessment or penetration-test report from evidence. Use when findings, scope, methodology, limitations, impact, remediation, retest criteria, and an executive explanation need calibrated reporting.4---56# Report Security Assessment78## Overview910Produce a report that lets technical owners reproduce findings and non-specialists understand what matters. Preserve uncertainty, scope limits, and negative results that materially constrain conclusions.1112Read [references/security-report-shape.md](references/security-report-shape.md) for the required structure.1314## Workflow15161. Fix report identity.17 - Record title, client/project, assessment type, dates, version, authors, classification, and distribution.182. State scope and authority.19 - List included/excluded targets, environments, accounts/roles, techniques, time windows, constraints, and changes from the approved scope.203. Summarize outcomes plainly.21 - Explain what was found, affected assets, practical consequence, urgent actions, and material uncertainty without jargon or panic.224. Describe methodology and coverage.23 - Name standards/guidance, tools/versions, manual checks, evidence sources, assumptions, unavailable telemetry, and untested areas.245. Write each finding.25 - Include identity, status/confidence, affected assets, prerequisites, evidence/reproduction, impact, exposure, severity/vector if used, remediation, mitigation, and retest steps.26 - Keep raw secrets and unnecessary personal data out of the report.276. Record negative results and limitations.287. Build a remediation plan.29 - Group immediate containment, near-term fixes, structural hardening, owners, deadlines, and dependencies.308. Verify the report.31 - Cross-check evidence links, commands, screenshots, identifiers, redaction, scope, and status.3233## Output3435Return a self-contained report with executive summary, scope, methodology, findings, negative results, limitations, prioritized remediation, and retest plan.
gaelic-ghost