Security reports nobody reads, and how to fix that
A monthly report with two hundred findings and no owner is not a security process. It is a record of not deciding.
The report nobody reads
A monthly security report listing two hundred findings, sorted by a severity score, with no owner and no history, is not a security process. It is a monthly reminder that nothing was decided, and it trains everyone to ignore the next one.
The problem is not the tool. It is that nothing turns output into decisions.
Severity scores are context-free
A standardised severity score describes a vulnerability in the abstract. It does not know whether the affected component is exposed to the internet, whether the vulnerable path is reachable in your configuration, or what the system actually holds.
| Question | Effect on priority |
|---|---|
| Is it reachable from the internet? | Raises it sharply |
| Is the vulnerable feature enabled? | Often lowers it to nothing |
| What data is behind it? | Raises it |
| Is a fix available? | Determines the action, not the priority |
| Is it being exploited in the wild? | Raises it sharply |
| What breaks if we patch now? | Determines the timing |
What a usable report contains
- What changed since last time, first. New findings and closed ones, not the full list.
- An owner for anything that needs action, by name.
- A decision for everything else: accepted, deferred with a date, or not applicable with a reason.
- Trend over several periods, so drift is visible.
- A short summary a non-technical reader can act on.
- What was not checked, so nobody mistakes the report's scope for the system's.
Keeping the review from becoming a ritual
Two habits do most of the work: opening the review with what changed rather than the whole list, and finishing it with a decision on every new item. A review that ends without decisions will be shorter next month and absent the month after.
Reports are not certificates
A clean report says the checks that ran found nothing they recognise. It does not certify that a system is secure, and it should never be presented to a customer or a board as if it did. The scope of the check belongs in the report precisely so that nobody makes that leap.