Insights · Field note · Method and principles
Proof over promises: how we write a report
A report is read by people who cannot check the work. It is written so that they could.
Every report we write, an assessment, a readiness review, a monthly evidence report, follows the same rules: it states what was examined and how, it grades findings by consequence rather than by tool severity, it references the evidence behind every finding and the source behind every figure, it says what was not examined and what could not be verified, it ends with decisions required and a recommendation with its reasoning, and it says bad news plainly. The reader is someone who cannot repeat the work: an executive, a board, an auditor, an insurer, a buyer. The report is written so that if they could, they would find what we found.
In detail
What the evidence shows.
Scope and method first
What was in scope, what was out, how the work was done, over what period, with what access. A finding without its method is an opinion. The method is stated so that a second examiner could repeat it and so that the limits are honest.
Findings by consequence
A scanner rates severity by the vulnerability. A report rates by what the finding means for the organization: what it could stop, expose or cost. The same technical finding is critical in one environment and minor in another, and the report says which and why.
Evidence and sources
Every finding references the evidence: the configuration, the log, the test, the record. Every figure carries its source. Where the evidence was unavailable, the report says so rather than inferring. This is the standard our published pages also follow, which is why each carries its sources.
Decisions and bad news
The report ends with what the reader must decide and what we recommend, with reasoning. Bad months and bad findings are stated with their causes; a report that only ever says green is not trusted when it matters. See executive risk reporting, monthly evidence report and the editorial standards.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days