Reports

^{Last Updated: 2026-08-20}

Purpose

This article describes the structure, sections, and available content of reports generated in the Outpost24 Portal, including how report data is presented across different report types, detail levels, delivery methods, and report formats.

Introduction

Reports in the Outpost24 Portal provide a structured way to analyze and present vulnerabilities, compliance issues, delta comparisons, and remediation solutions for one or multiple assets, enabling security teams to gain actionable insights into their environment. Reports allows users to generate tailored reports with customizable detail levels—such as summary, management, or detailed views—in formats like PDF for visual clarity, Excel for tabular data, or XML for system integration, with options for secure compression and password protection. By supporting on-demand generation or scheduled delivery via email, direct download, or storage in the Report Library, reports streamline security assessments, facilitate compliance with industry standards, and enhance decision-making by delivering precise, accessible data to stakeholders. Reports integration with view templates and tag-based scoping ensures focused reporting, while alignment with CVSS metrics and OWASP-guided testing provides robust vulnerability analysis, making it essential for maintaining a secure and compliant infrastructure.

Requirements

It is assumed that the reader has basic access to the OUTSCAN/HIAB account. 

Report Types

The Outpost24 Portal supports several report types intended for different security and compliance use cases.

Vulnerability reports focus on identifying and presenting security weaknesses discovered during assessments or scanning activities. These reports typically contain severity classifications, risk scoring, vulnerability descriptions, remediation guidance, and references to external security standards such as CVE and CWE.

Compliance reports are designed to evaluate assets against selected frameworks, policies, or regulatory requirements. These reports emphasize compliance status, failed controls, and overall adherence to security standards.

Delta reports compare findings between reporting periods and help organizations identify newly discovered vulnerabilities, resolved findings, and changes in overall risk exposure over time.

Solutions reports focus primarily on remediation activities and corrective actions. These reports help operational teams prioritize patching, configuration updates, and other mitigation efforts.

View Templates

View Templates are predefined filter definitions that determine which findings are included in a report. A template can define applications, filters, grouping, and displayed columns, allowing reports to present findings in a consistent and meaningful way.

Reports support both built-in and custom templates, enabling organizations to standardize how findings are presented. Built-in templates provide common reporting scenarios, while custom templates allow users to create reports tailored to their organization's specific requirements.

Templates can focus on remediation status, compliance requirements, or testing methodologies. For example, organizations can generate reports that include only unresolved findings, findings older than a specified age, or vulnerabilities mapped to specific security frameworks.

The selected View Template determines both the content and the structure of the generated report.

For more information, see  View Templates and Generate Reports. .

Report Sources

Reports can be generated from several different sources.

• Finding reports - are based on one or more findings from the Vulnerabilities or Solutions views and contain all the selected vulnerability findings.

• Asset reports - are based on one or more assets from the Asset view and contain all vulnerability findings associated with the selected assets.

• Asset group reports - are based on one asset group from the Asset group view and contain all vulnerability findings associated with the selected asset group.

Report Levels

Report levels control the amount of information included in a report. Select a report level based on the intended audience and the level of technical information required.

Management reports provide an executive-oriented overview of the organization’s security posture. These reports emphasize risk exposure, trends, and business impact while minimizing technical detail. Typical management reports include risk summaries, charts, severity distributions, and high-level remediation priorities.

Summary reports provide a balance between executive visibility and operational detail. They are commonly used by project managers, operational teams, and security coordinators who require insight into findings and remediation progress without extensive technical analysis.

Detailed reports contain complete technical information for each finding and are intended for analysts, administrators, consultants, and remediation teams. These reports include technical evidence, CVSS metrics, discovery details, vulnerability descriptions, remediation instructions, and external references.

Besides the Title page, the reports contain the following sections:

Report Formats

Reports can be exported in multiple formats depending on how the information will be consumed or processed.

PDF is the most commonly used format and is optimized for readability, presentation, and customer-facing reporting.

Excel formats provide structured tabular data suitable for operational analysis, filtering, and remediation tracking.

XML exports support integrations and automated workflows where report data must be consumed by external systems.

The available formats may vary depending on the selected report type and template.

Scope and Filtering

Reports can be generated for individual assets, asset groups, or dynamically filtered scopes using Tags and View Templates. Tag-based filtering enables organizations to generate focused reports for departments, projects, environments, or business units without manually selecting assets each time.

The reporting scope directly affects the findings, trends, and remediation information included in the generated output.

For more information, see Tags article.

Report Overview

Title Page

The title page provides information about the report such as:

• Report Type - Management, Summary, or Detailed reports.

• Created by - Name of the person who created the report.

• Version number

• Report ID

• Report Interval - Dates between from which the content of the report has been obtained.

• Creation date with timezone - Date and time when the report was created together with in which timezone.

The title page is followed by a table of content.

Executive Summary

The Executive Summary provides a high-level overview of the assessed environment and identified risks. This section is intended primarily for management and decision makers who require a quick understanding of the organization’s current security posture.

The summary commonly highlights the total number of findings, severity distributions, major risks, remediation priorities, and changes in risk exposure over time. Charts and graphical elements are often included to visualize trends and risk concentrations.

Use the Executive Summary to quickly assess the security posture of the reported environment and identify areas that require attention. The summarized format is particularly useful for stakeholders who need an overview without reviewing individual vulnerability details.

Depending on the selected report configuration, the executive summary can optionally be excluded.

Risk Level Overview

The Risk Overview section summarizes findings according to severity classifications such as Critical, High, Medium, Low, and Recommendation. It also provides information about how many findings that are Open, Fixed, and Accepted, showing the progress of remediation.

The purpose of this section is to provide visibility into the overall distribution of security risks across the reporting scope.

Trend

The Trend section provides historical context by illustrating how findings evolve between reporting periods. This provides a historical view of the risk distribution and makes it possible to track changes across multiple assessments, thus enabling organizations to monitor whether their security posture is improving, stable, or deteriorating over time.

Use the trend information to identify increases or decreases in findings at different risk levels. This helps determine whether the security posture is improving, remaining stable, or requires additional remediation effort.

Delta Overview

The Delta Overview shows how findings changed during the selected reporting period. It provides a comparison between scan results, making it easier to understand how the security posture has developed over time.

Findings are categorized as Unchanged, Added, or Removed. Unchanged findings remain present, Added findings are newly detected, and Removed findings are no longer detected compared with the previous results.

The Delta Overview can be used to identify new vulnerabilities, monitor unresolved findings, and track remediation progress. This provides insight into whether the number of findings is increasing or decreasing and highlights areas that require further attention.

Top 10 Findings

The Top 10 Findings section provides an overview of the ten most frequently identified vulnerabilities in the report. Findings represent security issues detected on the assessed assets and can range from security recommendations to confirmed exploitable vulnerabilities.

Each finding is associated with one or more affected assets and includes information such as severity, vulnerability description, and recommended solution. The overview helps identify vulnerabilities that affect a large number of assets and highlights recurring security issues across the assessed environment.

Top 10 Solutions

The Top 10 Solutions section shows an overview of the remediation actions associated with the findings in the report. A solution describes the recommended action for resolving one or more identified vulnerabilities, such as applying a patch, updating affected software, changing a configuration, or implementing a workaround.

Grouping findings by solution helps identify remediation actions that address multiple findings or affected assets. This provides a remediation-focused view of the assessment and helps security and operations teams prioritize actions that can reduce the overall number of vulnerabilities efficiently.

Risk Summary

This section provides a summary of the findings in this report, organized according to the OWASP Top 10 categories. Each category lists the reported findings, along with their assigned risk severity and the affected target(s).

The Open Worldwide Application Security Project (OWASP) Top 10 identifies the most critical categories of web application security risks. It is intended to help organizations prioritize remediation efforts by focusing on the most common and impactful application security weaknesses.

At the top of each category, the overall risk severity is displayed. This severity corresponds to the highest risk severity assigned to any finding within that category.

The information given here helps to understand the scope and overall risk distribution of the assessed environment without reviewing individual findings. The summary provides context for the more detailed vulnerability information included later in the report.

Findings Summary

The Findings Summary section provides a condensed overview of the vulnerabilities or compliance issues included in the report. Information commonly includes the finding name, severity, status, affected asset, and discovery information.

In management and summary reports, this section is typically concise and focused on prioritization. In detailed reports, the findings summary acts as an index leading into the full technical analysis.

This section lists the specific vulnerabilities included in the report. It is an optional table that can be added to Detailed Vulnerability, Management, and Summary level PDF reports by selecting the Include Summary table option during report creation. Use the table when report recipients need information about individual findings without requiring a Detailed report.

Risk Details

Detailed reports contain an extensive Risk Details section for each finding. This section includes technical information required for investigation and remediation activities.

Each finding generally contains a vulnerability title, severity level, status, risk factor, and discovery date. Additional information may include CVSS scoring metrics, vulnerability descriptions, exploitation risks, and business impact explanations.

The Solution section provides remediation guidance such as patch recommendations, configuration changes, mitigation strategies, or vendor advisories. References to external resources including CVE identifiers, CWE mappings, OWASP categories, and vendor documentation may also be included.

Some reports additionally contain Outpost24 Farsight risk information, which provides prioritization insights based on threat activity, likelihood scoring, and exploitation trends.

Risk

Status - Indicates the different statuses for a finding. Can be marked as:

• Accepted - Displays if the risk is accepted or not.

• False Positive - The scanner is finding a risk that has been marked by someone to be a false positive and is not supposed to pick up on.

• Fixed - Shows if the vulnerability has been marked as fixed.

• Irreproducible - AppSec not able to reproduce finding

• Pending Verification - Shows if there is any pending verification request

• Present - (Default) Shows that a Finding is present after scanning

Status verified - A text that is “This fix has been verified by a security consultant” if an APPSEC/OFFSEC finding was marked as FIXED by a GhostLabs consultant or “This fix has not been verified by a security consultant” if by customer user.

Tags - Displays the available tags associated with the finding.

CVSS - The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The numerical score can then be translated into a qualitative representation such as Low, Medium, High, and Critical to help organizations properly assess and prioritize their vulnerability management processes

Description - A detailed explanation of the finding with information about the nature of the vulnerability and its potential impact on the affected system.

Solution - The solution section provides an actionable advice on how to remediate the vulnerability as well as detailed information about the context of the vulnerability where it was found.

Category - Solution category: Workaround, Patch, Update, Contact Vendor,

Reference
Vendor - Links to vendor for information about the solution
Advisory - Links to advise about the solution

CVE - Common Vulnerabilities and Exposures (CVE) entry of the vulnerability. CVE is a list of publicly disclosed computer security flaws that's been assigned a CVE ID number. https://www.cve.org/

CWE - Common Weakness Enumeration (CWE™) is a community-developed list of common software and hardware weaknesses that have security ramifications. A weakness is a condition in a software, firmware, hardware, or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.

Bugtraq - Bugtraq ID of the vulnerability.

CAPEC - Common Attack Pattern Enumerations and Classifications (CAPEC™) is a catalog of known cyber security attack patterns used to prevent attacks. Same information as in the Detailed tab.

OWASP Top 10 2004, 2013, 2017, 2021 - The Open Worldwide Application Security Project (OWASP) Top 10 is a standard awareness document for developers and web application security, and represents a broad consensus about what the most critical web application security flaws are.

Farsight risk - <num> The Likelihood feature in Outpost24® Farsight provides an easier way to address vulnerabilities that are relevant and may impact an organization irrespective of the CVSS score or the presence of an exploit for a vulnerability.

Farsight risk delta - <num> The change in Farsight risk delta similar to Likelihood delta but with the new range.

Farsight risk update date - <date> Date when the Farsight Risk value was updated.

Threat activity - <date> Last time date when threat activity has been detected by the watcher community.

Age - Number of days since the finding was first detected.

Check ID - The rule ID that triggered the finding.

External references - shows the related reference links for a finding as comma-separated URLs.

Attachment - additional information such as images, text, json code.

Methodology

The Methodology section explains the approach used to perform the security assessment and evaluate the identified risks. It provides context for how the assessment scope is analyzed, how potential security issues are investigated and verified, and how confirmed findings are documented and scored.

The assessment methodology is based on established industry standards and security testing frameworks, including OWASP, ISO, PCI SSC, OSSTMM, NIST, and CVSS. This provides a consistent and recognized approach to security testing, risk evaluation, and reporting.

Use this section to understand the principles and standards that support the assessment results presented in the report, including how findings are validated, assigned a risk score, and documented with relevant vulnerability references and remediation recommendations.

Activities

The Activities section lists the security testing activities performed during the assessment, describing the main stages of the testing process from initial discovery and identification of systems and services to vulnerability analysis, validation, and reporting.

The activities cover network and application scanning, identification of components and services, research into known vulnerabilities and configuration issues, and controlled testing of identified weaknesses. Testing that could affect the confidentiality, integrity, or availability of data is handled in coordination with the customer.

This section helps you to understand the technical activities that contributed to the assessment results and how the collected vulnerability information and supporting evidence were analyzed before being included in the report.

Explicit Exceptions

The following tests were not executed during the testing:

Denial of Service Attacks - The result of a denial of service attack might cause the application to cease normal behavior. Therefore, attacks of this type will not be executed, unless explicitly requested by the customer.

Social Engineering - In social engineering, an adversary attempts to gain access or otherwise manipulate an application by attacking the people and employees with privileged access, e.g. by enticing them to divulge information.

Physical Security - Physical security is the protection of personnel, hardware, programs, networks, and data from physical circumstances and events that could cause serious loss or damage to an enterprise, agency, or institution.

OWASP Top 10 Description

The OWASP API Top 10 2023 and OWASP MOBILE Top 10 2024’s ranks and names to the following sections of the report: Executive Summary, Risk Summary. Depending on the type of the asset group(s) on which the report is generated for, the corresponding OWASP info is displayed. If the asset group is of type API, then OWASP API Top 10 is included. If the asset group is of type Mobile, OWASP Mobile Top 10 is included. For all other asset group types, the normal OWASP Top 10 is included.

In the Risk Details section, each vulnerability show which rank, if any, of the OWASP Mobile Top 10 or OWASP API Top 10 that it is categorized as. For example:

OWASP API Top 10 2023

The OWASP API Top 10 is a powerful awareness document for web application security, which represents a broad consensus
about what the most critical web application security flaws are.

OWASP Mobile Top 10 2024

The OWASP Mobile Top 10 helps developers and security teams prioritize what to protect in mobile apps. It is based on real-world data such as vulnerability databases, incident reports, assessments. It also provides guidance on mitigations and how to fix or reduce risk.

Common Vulnerability Scoring System (CVSS) v2 Description

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat. Scores are calculated based on a formula that depends on several metrics that approximate ease of exploit and the impact of exploit. Scores range from 0 to 10, with 10 being the most severe. While many utilize only the CVSS Base score for determining severity, Temporal and Environmental scores also exist, to factor in availability of mitigation and how widespread vulnerable systems are within an organization, respectively.

Access Complexity (AC)

Access Vector (AV)

Authentication (Au)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

Test Case Appendix - SWAT

SWAT is a hybrid service delivery covering automated monitoring and web application scanning as well as at least quarterly penetration testing, including application logics, of web applications under service.

The test-cases are oriented around the OWASP TESTING GUIDE, and for the application the following controls has been performed. Note that a control will be marked as audited either if found present and audited, or were found not present and hence not auditable - This to show that the application has been audited for this class of risks.