What's in a signed security report

Continuous testing only means something if it ends in something you can hand over. Every Rheono engagement ends in a signed, dated report (the Sicherheitssnapshot), written for the auditor who will read it, not for the tool that produced it. The full public sample is at /sample-report, with fictitious data; this is what each part is for.

Scope, in writing, first

The report opens with the agreed scope: which hosts and endpoints are covered, which techniques were used (external, non-mutating, auth tests with provided test accounts), the test window, and what was explicitly out of scope. If it is not in the scope line, it was not tested, and the report says so.

Findings that survive an audit

Each finding carries the full evidence chain: a CVSS 3.1 score with its vector, a CWE classification, the ISO 27001 and NIS2 controls it maps to, a reproducible proof of concept, and a concrete remediation. In the sample, the critical IDOR (sequential order IDs exposing other customers' history) scores 9.1 with the vector, CWE-639, and the exact control mapping printed next to it.

The loop is the point

One-off reports go stale the day they are signed. The sample shows the standing hunt's difference: the critical IDOR was found on 24.08, fixed in release 2026.08.2 on 25.08, retested on 26.08 and verified closed, while the high SQL injection stays open in the next cycle, because that is the honest state. The next intensive hunt starts when the customer approves a release and prioritizes the modules that changed.

Signed, in English or German

A named signatory signs every report; compliance frameworks want a person, not a pipeline. Reports ship in English or German, with everything in writing: price, scope, and no-gos. No finding is included that was not validated by a deterministic check and an adversarial review; unproven findings are never shipped.

If you want the shape before you buy it: the sample report is public, with made-up findings and the real structure. If the question is the price, the market ranges and the flat comparison sit on the pentest cost page.