SAMPLE DELIVERABLE / NOT A REAL ASSESSMENT
Security assessment.
A practical route to remediation.
This example shows how a scoped assessment can communicate findings to business and technical teams. The assets, observations and priorities are fictional. No security tests were performed for this sample.
01 / Executive summary
The sample review focuses on a customer portal, its API, private exports and account recovery. The first actions are to enforce account boundaries and restrict export access, followed by consistent session revocation after recovery.
Each action has a proposed owner and a verification case. Priorities in a real engagement consider exposure, exploitability and business impact; a finding count is not a security score.
02 / Scope & coverage
| Area | Included in this example | Boundary |
|---|---|---|
| Customer portal & API | Representative user roles and account separation | Agreed routes and synthetic records |
| Private export storage | Intended audience compared with storage access | Selected policy and synthetic export |
| Account recovery | Existing session behaviour after recovery | Agreed session types and test account |
A production report identifies the testing window, environment or build, access used, tested cases, exclusions and assessment limits. This sample does not contain exploit instructions, credentials or private records.
03 / Technical findings
WEB-01 · High · OPEN / SAMPLE
Customer records cross an account boundary
- Business impact
- A sample authenticated account could reach another account’s records.
- Evidence summary
- Two agreed test identities were compared against a controlled sample record. The expected account boundary did not hold consistently.
- Remediation direction
- Apply server-side ownership and permission checks on the affected operations. Review related routes and add account-boundary regression cases.
- Suggested owner
- Engineering / application team
- Retest acceptance case
- Recheck the original cross-account case and legitimate access for each relevant role.
CLD-02 · High · OPEN / SAMPLE
Private exports inherit public storage access
- Business impact
- A synthetic export intended for an internal audience was reachable through a public storage policy.
- Evidence summary
- The intended audience was compared with the selected object and storage access configuration.
- Remediation direction
- Restrict public access for private exports, review the export service permissions and account for existing objects and legitimate delivery paths.
- Suggested owner
- Platform team
- Retest acceptance case
- Verify unauthenticated access is restricted and approved identities retain the required access.
IAM-03 · Medium · OPEN / SAMPLE
Old sessions remain active after a password reset
- Business impact
- A previously active sample session remained usable after account recovery.
- Evidence summary
- The agreed recovery policy was compared with the behaviour of an existing test session after a reset.
- Remediation direction
- Define and implement the required revocation behaviour across relevant sessions, tokens and clients.
- Suggested owner
- Application team / identity integration
- Retest acceptance case
- Repeat the recovery case and verify both old-session revocation and the intended new sign-in.
04 / Remediation & retest register
| Reference | Owner | Status | Closure evidence |
|---|---|---|---|
| WEB-01 | Engineering | Open | Original case restricted; intended access preserved |
| CLD-02 | Platform team | Open | Private object restricted; approved access verified |
| IAM-03 | Application team | Open | Recovery session policy verified across agreed clients |
Where retesting is included, the record identifies the reviewed change and cases, marks each outcome and distinguishes open findings from items not rechecked.
05 / Assessment limits
An assessment reflects the agreed assets, access, test cases and testing window. It cannot establish that every vulnerability has been found. Subsequent changes can introduce new risks. A report should state those limits and identify any untested areas.