Lab 3 — Full engagement report
Kick-off in week 13 · due in week 14
Context
A simulated engagement is provided, with RoE, initial mapping and execution logs. You do not run new attacks: you write the final report as if you had run the engagement end to end.
Learning objectives
- Assemble a report read by both executive management and the technical teams.
- Prioritize based on business impact, not just on CVSS.
- Propose a credible remediation plan over time.
Expected deliverable
A PDF report of 20 to 30 pages, structured as follows:
- Executive summary — 1 to 2 pages, no jargon, with the conclusion up front and the heatmap of findings.
- Scope and methodology — RoE recap, tools, windows.
- Detailed findings — six minimum, imposed template (title, severity, context, evidence, impact, remediation, references). Minimum spread: two P1, two P2, two P3 or more.
- Remediation plan — actions at 3 months, 6 months, 12 months, with effort estimate and suggested owner.
- Appendices — raw scan output, complete requests, dated screenshots.
Grading grid (100 points)
| Criterion | Points |
|---|---|
| Executive summary understandable without jargon | 15 |
| Six findings respecting the template | 30 |
| Spread and coherence of severities | 10 |
| Remediation plan across three horizons | 20 |
| Quality of evidence in appendices | 10 |
| Defensible prioritization | 10 |
| Clarity and presentation | 5 |
Quality standards
- Every finding has a testable remediation.
- Every piece of evidence is dated, identified, unaltered.
- No "black-box" tool without an explanation of what it really does.
- The executive summary stands on its own without the detailed findings.