A field note on writing useful security reports

A useful report helps a reader see what was examined, what was observed, and where confidence ends. This sample writeup also demonstrates every component of the shared reading template.

This example shows the shape of a reading page, not approved guidance. The same Markdown format will carry Learn lessons, so each component below can sit between ordinary paragraphs.

Start with the question

Give the reader enough context to understand why the observation matters. State the question plainly, then describe the scope in ordinary language. An explicit scope is easier to review than an implied one.¹

• What system or model was examined, and which version.
• What was out of scope, stated as plainly as what was in.
• Who the report is for, and what decision it supports.

Separate evidence from interpretation

Record what happened before explaining what it might mean. Distinguish direct observations from assumptions, and say when an example is illustrative. A short template like the one below keeps the layers apart.

## Finding: <short, specific title>
Scope:       <what was tested, and what was not>
Observed:    <what happened, quoted where possible>
Interpreted: <what you think it means>
Confidence:  <low | medium | high, and why>
Limits:      <what this does not show>
<!-- sample template, adapt freely -->

Keep the layers visible

Readers skim. Headings such as Observed and Interpreted let them find the layer they need without rereading the whole report.

Give the report a structure

A consistent order helps reviewers compare reports. One possible order:

1. Summary in two or three sentences.
2. Scope and setup.
3. Observations, each with its evidence.
4. Interpretation and confidence.
5. Limits and suggested next steps.

A finding the reader cannot check is a claim, not a finding.

Make limits visible

Describe what was not examined and what remains uncertain. Limits help a future reader avoid overgeneralizing from one observation.

Finally, say what you would try next. It turns a report into an invitation to review.