Reports

Ethiack provides a set of reports that serve different audiences and purposes — from management summaries to compliance evidence to raw data exports. All reports are classified TLP:AMBER and should be treated as confidential.

Security reports

• Executive Report — a non-technical, management-facing summary of findings, business impact, and remediation roadmap. The right document to share with a CISO, board, or leadership team.
• Technical Report — the full technical deliverable for security and engineering teams. Contains per-finding detail including exact reproduction steps, raw HTTP evidence, CVSS scores, CWE classifications, and remediation guidance.

Compliance reports

• OWASP Top 10 Report — findings mapped against the OWASP Top 10 (2021) risk categories. Includes a Compliance at a Glance table, EPSS scores, and a full explanation of Ethiack's scoring methodology. Designed for auditors and vendor due diligence.
• OWASP WSTG Report — findings mapped against the OWASP Web Security Testing Guide. Demonstrates that specific test procedures were executed, not just that vulnerability classes were checked. Includes a three-horizon strategic remediation roadmap.
• PCI DSS Report — findings mapped to specific PCI DSS control requirement numbers. The correct document for QSAs, payment processors, and internal compliance teams. Includes per-severity retesting SLAs and evidence requirements for audit closure.

Data exports

• Findings CSV Export — a flat-file export of all findings from a given test, including severity, CVSS score, CWE, CVE references, and direct links back to the Portal. For use in external tools, ticketing systems, and custom workflows.
• Asset Inventory — a full export of all assets in your organization's surface, including type, importance, detected technologies, and infrastructure details. Useful for audits and asset management.