Transilience Report Style

Transilience AI — Threat Intelligence Report Design System

Version: 5.0 — Light theme (modern, minimal, professional)
Format: PDF (A4), ReportLab
Last Updated: July 7, 2026

0. Theme (v5.0)

The report now renders a light theme by default (white page, dark ink, brand accents). Both palettes live in the THEME dict in generate_report.py; select with --theme light|dark (or engagement.theme). Precedence: --theme > engagement.theme > light; an unknown value falls back to light (never errors). The pentest-engagement finalize gate passes no --theme, so all gated PDFs are light. The sections below marked "(dark fallback)" describe the retained --theme dark palette.

0.1 Light palette (brand: purple #6941C6 → magenta #C9317C)

0.2 What v5 adds / changes

• Light, airy layout — white surfaces, hairline separators, generous padding/leading; colour used only semantically (severity / score / status).
• Colour-coded risk & score — severity via the finding-card left stripe + [SEV] tag; and in every risk table (findings summary, CVE register, per-finding CVE table) both the severity label and the CVSS score cell are band-coloured + bold — the label by its severity, the score by score_band(score). tbl(..., sevcol=, scorecol=) selects the columns; the colour is emitted as an inline <font> tag inside the cell (a TableStyle TEXTCOLOR is ignored on ReportLab Paragraph cells, so it must live in the cell markup). Empty/non-numeric score cells stay uncoloured.
• Highlighted code/samples — codebox() renders CVSS vectors, PoC/test requests, affected assets, and endpoints in a bordered light-grey monospace block; screenshots are framed with a border + caption.
• Finding cards are a single-column multi-row Table (severity left-stripe + hairline box + padding) so tall Critical findings split cleanly across pages (border redrawn per fragment).
• Logo is drawn at its true aspect ratio (1024×468 → 0.457; ~48mm wide) — never squished.
• Graphical (severity-bar chart) + Tabular (findings index) summaries, DURATION cover row, per-finding Ease of Exploitation + References, and a Conclusion section are all light-themed.

1. Page & Document Configuration

2. Typography

2.1 Font Stack

Family Registration: Carlito is registered as a full family (normal, bold, italic, boldItalic) enabling automatic style switching via ReportLab's <b> and <i> XML tags.

2.2 Type Scale

2.3 Advisory Card Typography

3. Color Palette

3.1 Backgrounds — dark fallback (--theme dark; light palette in §0.1)

3.2 Brand Colors

3.3 Text Colors

3.4 Severity Colors

3.5 Accent Colors

3.6 Gradient Specification

The brand gradient is a linear interpolation between two endpoints used across multiple components:

Rendered as: 80 discrete steps, left-to-right. Used in: page top rule (3.5pt), section dividers (2pt), cover separators (3pt), progress bars, card bottom dividers.

4. Component Library

4.1 GradientLine

A full-width or partial-width horizontal rule using the brand gradient.

4.2 GradientBar

A proportional progress bar with gradient fill and rounded track.

4.3 CardBox

A bordered container with optional accent sidebar. Used for posture items, recommendations, methodology phases.

4.4 MetricBox

A compact KPI display used in the executive summary row.

4.5 SeverityBadge

A colored pill showing severity level.

4.6 SectionNumber

A large decorative section number with ghost double-strike effect.

4.7 ScoreRow

Three horizontal inline score bars stacked vertically.

Dynamic color rules:

4.8 AccentBar (Card Top)

A thin colored bar at the top of each advisory card.

4.9 TechStackBlock

A category block displaying technology items as a bulleted list.

5. Page Template

Applied to every page via the page-template onPage hook. Light default: white page fill, a 2.5pt brand gradient hairline at the very top, and a hairline-ruled footer (muted text + purple page number) — no dark footer bar. The dark-fallback specifics below apply under --theme dark.

5.1 Background Fill

• Full page PAGE rectangle — #FFFFFF light · #07040B under --theme dark

5.2 Top Gradient Rule

• Brand gradient (80 steps, BP → BM), 3.5pt height, full page width, positioned at page top

5.3 Footer Bar

5.4 Left Accent Strip

• 2.5pt wide vertical bar, full page height minus footer, rgba(105, 65, 198, 0.12), positioned at x=0

6. Radar Visualization

A custom Flowable rendering a polar threat radar.

6.1 Dimensions

6.2 Background Glow

Concentric filled circles from max_r + 20 down to 0 (step −2), each with increasing alpha (0.03 → 0.05), color rgba(10, 5, 20, alpha).

6.3 Ring Grid

4 dashed concentric rings at 25%, 50%, 75%, 100% of max radius.

• Ring stroke: rgba(105, 65, 198, 0.3), 0.5pt, dash pattern (3, 3)
• Labels positioned along 15° angle from center at each ring's radius, Poppins-Medium 7pt

6.4 Sector Spokes

12 spokes at 30° intervals, representing attack surfaces:

Web Apps/API, Cloud/Infra, Network, Endpoints, Email, Mobile, IoT/OT, Data Storage, Identity, Third-Party, Physical, Social Eng.

• Spoke stroke: rgba(105, 65, 198, 0.25), 0.3pt
• Labels: Poppins-Medium 9pt, white, at max_r + 32 from center
• Alignment: centered if near vertical, left-aligned if right half, right-aligned if left half

6.5 Center Crosshair

• 16pt arms, color rgba(140, 92, 230, 0.4), 0.4pt
• Center glow: 16 concentric circles, rgba(105, 65, 198, 0.04 × (16−r))

6.6 Threat Points

Each threat plotted using theta_deg and radius_norm from data.

Three-layer rendering per point:

1. Outer glow: severity color at 0.12 alpha, radius + 7pt
2. Mid glow: severity color at 0.25 alpha, radius + 3pt
3. Core dot: severity color at 0.9 alpha, exact radius
4. Specular highlight: white at 0.3 alpha, offset (−0.15r, +0.15r), radius 0.35r

7. Advisory Card Structure

Cards are returned as flat lists of Flowables (not wrapped in CardBox), enabling ReportLab page-split. Between cards: CondPageBreak(220) — only breaks if <220pt space remains.

7.1 Card Layout (top to bottom)

7.2 Metadata Row Format

Source: THREAT INTEL │ Surface: Endpoint / Email │ Status: NEW │ First Seen: 2026-02-24

Labels in BPL (#8B5CF6), values in T2, separator: unicode │ (U+2502) with 4-space padding.

Source label mapping: threat → THREAT INTEL, product → PRODUCT VULN, breach → BREACH INTEL.

7.3 Detection Evidence Format

• {TechName}  —  {evidence_string}

Tech name in T1 (white, bold), em-dash separator, evidence string in T2. Max 6 items per card.

7.4 Section Header Coloring

8. Cover Page Layout

8.1 Structure (top to bottom)

8.2 Metadata Fields

9. Table of Contents Layout

10. Report Section Blueprint

10.1 Standard Section Header Pattern

Every numbered section follows this sequence:

1. SectionNumber(num) — decorative ghost number (38pt height)
2. Section title in h1 style (Poppins-Bold 20pt)
3. GradientLine(CW, 2) — full-width separator
4. Spacer(1, 4*mm) — breathing room

10.2 Section Inventory (12 sections)

11. Spacing System

11.1 Vertical Rhythm

11.2 Table Padding

12. Data-Driven Components

12.1 Evidence Map Architecture

Technology evidence is extracted from techstack_report.json and indexed by keyword. The extraction traverses:

• technologies.frontend[] — name, evidence[].finding, evidence[].details
• technologies.backend[] — web servers, frameworks, CMS, languages
• technologies.infrastructure[] — DNS, CDN providers
• technologies.security[] — WAF, certificates, headers, email security
• technologies.third_party[] — analytics, collaboration tools

Each evidence item is indexed under multiple keywords derived from the technology name fragments. Alias mappings expand coverage (e.g., email → proofpoint, microsoft, dmarc).

12.2 Threat-Evidence Matching

get_threat_evidence(threat) scans the threat's title, summary, and threat_name against the keyword index. Returns up to 6 (tech_name, evidence_string) tuples. Deduplication by {tech_name}:{evidence} key.

12.3 Severity Sorting

All threats sorted by: severity rank descending (critical=4, high=3, medium=2, low=1), then prioritization_score descending. Split into four lists for section rendering.

13. Unicode Characters

14. Adaptive Behaviors

14.1 Page Break Strategy

14.2 Card Splittability

Advisory cards return flat list[Flowable] instead of monolithic CardBox. This allows ReportLab's frame to split cards across page boundaries at any Paragraph/Spacer seam, eliminating blank pages.

14.3 Client Adaptation

The design system is client-agnostic. Customized per client:

• Cover: client logo, name, sector, region, report ID
• Executive summary: narrative and key findings
• Attack surface: domain/subdomain inventory
• Evidence map: keyword aliases tuned to client's tech stack
• Security posture: assessments specific to client's infrastructure
• Recommendations: actionable items specific to client's vulnerabilities

All visual elements (colors, typography, spacing, components) remain identical across clients.