A report engineers can use and auditors can trust.

What's in the report

1. Executive summary: What was tested, when, by whom, the overall picture and the findings by severity, in plain language.
2. Scope and method: Assets in and out of scope, environments, test accounts and roles, testing window, and the methods and references used (OWASP Top 10, OWASP ASVS, OWASP API Security Top 10). Any limits on the test are stated.
3. Findings: For each one: title, affected component, severity rated by exploitability, CVSS score and CWE for reference, evidence, steps to reproduce, impact, how to fix, and references.
4. Remediation and retest: The status of each finding and the date its fix was confirmed.
5. Appendix: How severity is rated and what each status means.

Four statuses, defined

• Open Open: verified, not yet fixed.
• Fixed, awaiting retest Fixed, awaiting retest: your team says it's fixed; we haven't confirmed yet.
• Verified fixed Verified fixed: we retested and the fix holds.
• Accepted risk Accepted risk: your team decided not to fix, and recorded why.

The letter of attestation

A one-page summary signed by Aveas, for auditors and for customers' security reviews. It states the company and systems tested, the testing dates, the method, and the number of findings by severity with their remediation status at the date of the letter.

What the letter doesn't say

• That your company is certified or compliant with any framework.
• That your systems have no vulnerabilities.
• Anything about systems outside the stated scope.

It's evidence that an independent test happened and what came of it. That's what reviewers look for.

What it looks like

Sample · fictional company. Northwind Ledger Ltd, web application and API test.