What you actually get
A real, fully-anonymized example of the security assessment report a customer receives — findings proven, not guessed, each with evidence, a fix, and the compliance controls it affects.
Findings
The q parameter is concatenated into a SQL query without parameterization. An attacker can read or modify any data in the application database.
A benign boolean-differential probe (q=1' AND '1'='1 vs q=1' AND '1'='2) produced a true/false response split, confirming injection without extracting data.
Use parameterized queries / an ORM binding for the q parameter. A patch is attached as a pull request.
A bucket holding nightly customer CSV exports has a public-read ACL. Anyone with the URL can download the files.
Bucket ACL grants READ to AllUsers; an unauthenticated HEAD returned 200 on a sampled object key.
Enable S3 Block Public Access (all four flags) on the bucket. This change is staged for one-click approval.
A bundled dependency has a known remote-code-execution CVE, and the vulnerable function is reachable from your code (not just present).
Reachability analysis traced a call path from an HTTP handler to the vulnerable yaml.load() sink.
Upgrade to the patched version and switch to yaml.safe_load(). PR attached.
Two accounts with admin privileges do not have multi-factor authentication enrolled.
Directory API reports mfaEnrolled=false for two users holding admin roles.
Enforce MFA org-wide and require it for admin roles. A runbook ticket names the two accounts.
No DMARC record is published, so attackers can spoof email from your domain for phishing.
No TXT record at _dmarc.acme-sample.com.
Publish v=DMARC1; p=reject after a short p=none monitoring period. Exact record provided.
Content-Security-Policy and HSTS are not set, weakening defenses against XSS and protocol downgrade.
Response headers lack Content-Security-Policy and Strict-Transport-Security.
Add the headers at your edge/proxy. Copy-paste config provided.
Compliance posture
Get this report for your own company — free.
Connect one system and TensorShield produces this, proves which findings are real, and writes the fixes — you approve anything that matters.