Writing assessment reports and retesting
You write a clear report for different readers, explain findings with evidence and practical advice, present the results and close the assessment by retesting the fixes.
Level 401 · 17 lessons · 15 practice labs
Lessons
The structure of a report
- Who the report is for: executives, engineers, auditors
- The executive summary: explaining risk in business language
- Anatomy of a finding: title, impact, evidence, recommendation
- Severity: the CVSS score and adjusting it for context
- Short task: turn raw notes into a well-written finding
Writing clearly and accurately
- Reproduction steps: someone else must get the same result
- Practical remediation advice: the quick fix and the lasting fix
- Explaining finding chains: when small issues add up
- Report mistakes: exaggeration, vagueness and claims without evidence
- Redacting sensitive data and the distribution list
- Short task: rewrite three badly written findings
Delivery and retesting
- The readout meeting: presenting findings and answering questions
- Tracking remediation: owner, date and status
- Planning the retest: checking only what was fixed
- Validating a finding, fixing it and testing again
- The retest result and the closure letter
- Capstone: write the full report of a lab assessment and close it with a retest
Practice labs
- Turn raw notes into a well-written finding: Turn messy terminal notes into a single finding record with title, impact, evidence and recommendation sections.
- Score a finding with CVSS and adjust it for context: Calculate the base CVSS score for the given finding, adjust it for the asset's importance and compensating controls and justify it.
- Write an executive summary in business terms from technical findings: Turn the eight findings of the Ilgıntepe Tekstil assessment into a one-page risk summary for management with three priority decisions.
- Write reproduction steps someone else can follow: Complete a finding's missing steps, add the prerequisites and check the order of the steps is right.
- Rewrite three badly written findings: Rewrite three findings that are exaggerated, vague and unproven with measured language, clear impact and evidence.
- Explain the risk created when small findings combine: Explain with a chain diagram how three low findings form one serious path and recommend the cheapest fix that breaks the chain.
- Redact sensitive data in a report: Find passwords, personal data and internal addresses in the draft report and redact them without hurting readability.
- Set up a distribution list and version control for a report: Write the distribution list saying which report version goes to whom and encrypt the report file and record its hash.
- Make short-term and permanent fixes actionable: Turn five findings' generic advice into short-term and permanent fixes with owner, steps and verification method.
- Fill the remediation tracker with owner, date and status: From the debrief notes, enter the owner, target date and status for each finding in the tracker.
- Prepare answers for questions at the debrief: Prepare likely objections and short evidence-based answers for the three most debated findings in the report.
- Write an escalation note for overdue fixes: Separate the overdue findings in the tracker by severity and write a short escalation note for management.
- Retest this finding and update the report: Retest the finding reported as fixed on the lab target with the same steps and update its status in the report with evidence.
- Detect a partly fixed finding and refuse to close it: Show by retesting that the fix closed only one path, prove the remaining path and update the finding as open.
- Prepare the retest result and closure letter: Retest four findings on the lab target, separate closed from open ones and complete the closure letter with evidence attached.
About this course
You write a clear report for different readers, explain findings with evidence and practical advice, present the results and close the assessment by retesting the fixes.
What you will learn
- The structure of a report
- Writing clearly and accurately
- Delivery and retesting
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.