What's in a signed security report

Continuous testing only means something if it ends in something you can hand over. Every Rheono engagement ends in a signed, dated report — the Sicherheitssnapshot — written for the auditor who will read it, not for the tool that produced it. The full public sample is at /sample-report, with fictitious data; this is what each part is for.

Scope, in writing, first

The report opens with the agreed scope: which hosts and endpoints are covered, which techniques were used (external, non-mutating, auth tests with provided test accounts), the test window, and what was explicitly out of scope. If it is not in the scope line, it was not tested — and the report says so.

Findings that survive an audit

Each finding carries the full evidence chain: a CVSS 3.1 score with its vector, a CWE classification, the ISO 27001 and NIS2 controls it maps to, a reproducible proof of concept, and a concrete remediation. In the sample, the critical IDOR — sequential order IDs exposing other customers' history — scores 9.1 with the vector, CWE-639, and the exact control mapping printed next to it.

The loop is the point

One-off reports go stale the day they are signed. The sample shows the standing hunt's difference: the critical IDOR was found on 24.08, fixed in release 2026.08.2 on 25.08, retested on 26.08 and verified closed — while the high SQL injection stays open in the next cycle, because that is the honest state. The next intensive hunt starts when the customer approves a release and prioritizes the modules that changed.

Signed, in English or German

A named signatory signs every report — compliance frameworks want a person, not a pipeline. Reports ship in English or German, with everything in writing: price, scope, and no-gos. No finding is included that was not validated by a deterministic check and an adversarial review; unproven findings are never shipped.

If you want the shape before you buy it: the sample report is public, with made-up findings and the real structure.