DOMINION FORTRESS / Illustrative Deliverable
What a security assessment deliverable can look like
Illustrative sample only · No live system was assessed · No customer findings are represented here
Important: This is a fictional example created to explain report structure. The sample host example.test is reserved for testing. These are not findings about a real organization and must not be treated as a real assessment report.
Executive summary
A useful assessment report should explain the risk in plain language, distinguish evidence from assumptions, identify what needs action first and provide a practical route to remediation. It should not be a raw scanner dump.
- Assessment type: Illustrative external configuration review.
- Example scope: Fictional host
example.test; no live requests or intrusive testing performed.
- Example method: Review of hypothetical public response headers and configuration.
- Authorization: A real engagement would require written permission and an agreed scope before testing.
Example finding format
EXAMPLE-01 — Security header configuration could be stronger
Illustrative severity: Low to Medium, depending on application behavior and existing compensating controls.
Evidence (fictional): A hypothetical response from the sample host does not include a recommended browser security header.
Why it matters: Missing or weak browser security controls can reduce defense in depth. The actual risk depends on the application, content, authentication model and other controls.
Recommended action: Confirm the application requirements, configure an appropriate policy, test it in a staging environment, monitor for breakage and deploy with a rollback plan.
Retest criteria: Verify the expected header and policy are present on the relevant routes and that application functionality remains intact.
EXAMPLE-02 — Remediation ownership is not defined
Illustrative severity: Informational process observation.
Evidence (fictional): The sample issue tracker has no named owner or target date for a hypothetical recommendation.
Why it matters: Findings can remain open when ownership and verification criteria are unclear.
Recommended action: Assign an owner, target date, acceptance criteria and retest status for each agreed remediation item.
What a real engagement can include
- Executive summary and clearly defined scope.
- Methods used, exclusions, assumptions and limitations.
- Findings with evidence, impact, severity rationale and remediation guidance.
- Prioritized action plan and retest criteria.
- Optional remediation support and a follow-up review under an agreed scope.
Report depth depends on the agreed engagement. We do not promise a fixed finding count, a particular severity outcome or a clean result before testing.
Start with a defined scope
Tell us what you own, what you want assessed and what decision the assessment should support. We will clarify authorization, boundaries, access requirements and deliverables before intrusive testing begins.
Request a security assessment → Read the security testing policy
Methodology · Cybersecurity services · Free domain security scanner