Skip to content
Services
All servicesFind the right assessmentWeb & APIApplications, roles and tenant boundariesCloudResources and service relationshipsWeb3Contracts, wallets and connected systemsOur approachAI research and human validationDeliverablesEvidence, reporting and retestingWork with usScope an engagement
How it works Scope & safety Findings Review desk Blog Write to us
HomeServicesWhat your team receives
What your team receives

A finding is a start.
A decision is the outcome.

A useful security assessment helps leadership understand the risk and gives engineering enough context to act. Here is the reporting structure we propose for your engagement.

Discuss your scope ↗Explore our approach →
INSIDE THE ASSESSMENT
A report built for the next step.Illustrative report sections show scope, supporting evidence, impact and remediation. This is not a customer report or a product screenshot.ASSESSMENT STRUCTUREFrom evidence to action.01 ScopeAssets, context and limitations02 EvidenceExpected and observed behavior03 ImpactDemonstrated risk and preconditions04 RemediationGuidance and agreed retesting
A report built for the next step.
Illustrative structureNot a customer report
01 / Three readers, one assessment

Make the risk understandable.
Make the next step practical.

ScopeContextDecisionFOR PRIORITIZATION
LEADERSHIP

A clear view
of the assessment.

Decision-makers need the material observations in context, not a raw alert feed.

What matters
The scope, limitations and relevant business consequences of reviewed findings.
What to look for
A distinction between demonstrated behavior and broader assumptions.
What it supports
An informed discussion of priority, ownership and the next action.
EvidenceFixReviewFOR REMEDIATION
ENGINEERING

Enough detail
to evaluate the fix.

Engineers need to understand the affected boundary and its preconditions.

What matters
Affected components, relevant roles and reproduction context where appropriate.
What to look for
Expected versus observed behavior, with supporting evidence.
What it supports
A practical remediation discussion grounded in the demonstrated mechanism.
ChangeRetestStatusFOR FOLLOW-THROUGH
SECURITY OWNER

Keep the closure
decision grounded.

A fix and a verified outcome are related, but they are not the same record.

What matters
Which changes and conditions were actually included in the agreed retest.
What to look for
The observed result and any remaining limitations or untested areas.
What it supports
A scoped closure decision, not a declaration that the entire system is secure.
02 / Report contents

A finding should explain
more than what failed.

Proposed report content guide
SectionInformation includedWhy it matters
Engagement contextInformation includedAgreed assets, environments, roles, exclusions and constraints.Why it mattersThe reader knows what the assessment represents.
Technical findingsInformation includedMechanism, prerequisites, affected components and supporting observations.Why it mattersEngineering can evaluate the behavior in the correct context.
Impact & priorityInformation includedDemonstrated consequences and relevant assumptions.Why it mattersSeverity does not stand in for an explanation of impact.
RemediationInformation includedGuidance addressing the affected behavior or trust boundary.Why it mattersThe proposed next step is connected to the mechanism.
Coverage & follow-upInformation includedUntestable areas and the result of any agreed retesting.Why it mattersMissing coverage is not mistaken for a successful security check.
03 / Fix verification

A change is a proposal.
A retest is an observation.

Retesting is performed only as agreed. Its result is tied to the version, conditions and behavior assessed.

  1. 01

    Share the change

    Provide the relevant fix, version and any changed test prerequisites.

    CUSTOMER CONTEXT
  2. 02

    Agree the retest

    Confirm which findings, environments and scenarios will be revisited.

    DEFINED FOLLOW-UP
  3. 03

    Record the outcome

    Explain the observed result, unresolved concerns and testing limitations.

    REVIEWED STATUS

A scoped retest does not establish that unrelated behavior or the entire application is free of vulnerabilities.

04 / What you receive

See the structure.
Ask for a shareable sample.

This example describes the reporting format. It is not a customer report, a measured finding or evidence of a completed engagement.

Request a shareable report sample ↗
ILLUSTRATIVE STRUCTURE · NOT A CUSTOMER REPORT
ENGAGEMENT OUTPUT

Context. Evidence.
A useful next step.

01

Summary & affected scope

The behavior, environment, version and relevant roles.

02

Evidence & preconditions

What was expected, what was observed and under which conditions.

03

Impact & limitations

The consequences established by the evidence, and what was not established.

04

Remediation & follow-up

Guidance and agreed retest status.

05 / Before we start

Practical questions.
Clear expectations.

Bring your technical constraints and buyer requirements to the scoping conversation.

Can you share a sample report?

Ask for a shareable sample during the scoping discussion. The illustrative layout on this site is not an actual customer report.

Will the report satisfy our buyer?

Acceptance is not guaranteed. Share the buyer’s assessor, format and coverage requirements before the engagement so we can assess fit.

Are retests automatically included?

No assumptions should be made. Retest scope, timing and commercial terms are defined in the engagement.

Does the report certify compliance?

No. A security assessment report does not itself certify compliance or establish an absence of vulnerabilities.

Can we publish the report?

Disclosure, redistribution and use of names or logos need to follow the agreed terms and any relevant permissions. Do not assume a private report is approved for public publication.

LET’S DEFINE YOUR ENGAGEMENT

Bring us your scope.
We’ll discuss the next step.

Share your system, priorities and target date.
Please do not include credentials or sensitive findings.

Book a call ↗Email hello@zaaf.ai