Thorough testing. Confident decisions.

• An agreed, versioned scope

  Your testing team reviews the scope with you, and each change is kept as a numbered version. Nothing is tested until you approve a version and authorise testing.

• Reviewed findings

  Each finding describes the affected assets, the business impact, how to reproduce it and how to fix it, and is reviewed before it’s published to you.

• A report in the client portal

  Your report is published in the client portal together with your findings and any supporting evidence.

• A retest workflow

  Request a retest when you’ve fixed a finding, confirmed by someone in your organisation who can authorise testing, with the dates it may take place. A finding is resolved only when its retest passes, or shown as accepted when you accept the risk.

1. 01

   Report details

   The engagement title, your organisation, the report date, the authorised scope version and the testing type.

2. 02

   Executive summary

   An overview of the engagement and its results, written by your testing team.

3. 03

   Remediation priorities

   The number of findings at each severity, from Critical to Informational, with Critical and High findings marked for immediate review.

4. 04

   Approved scope and testing authorisation

   Who agreed the scope for 1ST Cyber, who authorised testing and when, with their job title, the authorised scope, the booked testing dates, a SHA-⁠256 fingerprint for each approved scoping document, and every authorisation under which testing took place, with its testing period and, if testing was stopped at your request, when. A report on the work done before a stop says so, with the reason you gave.

5. 05

   Methodology

   How your testing team approached and carried out the testing.

6. 06

   Findings

   Each finding, most severe first, headed by the reference the client portal also gives it (such as F-01): its severity and status, a CVSS score where one applies, the affected assets, description, impact, reproduction steps, any evidence notes and remediation guidance, and, where recorded, when it was observed, the HTTP request and response, and references such as CWE or OWASP.

Uploaded evidence files and retest results stay in the client portal rather than the PDF. Once released, retest results and any finding found in a retest are also published in a report update beside the report.

If a published finding changes later, such as its severity, or 1ST Cyber acknowledges your acceptance of its risk, this is published as a report update beside the report. The update logs every change and why it was made, prints each accepted risk with who accepted it and its review date, and shows what the finding was before. The report you were given stays as it was published.