Security Finding Template

Finding

• ID / title:
• Asset and owner:
• Severity:
• Status:
• Evidence confidence:

Executive Statement

In three sentences: what can happen, why the business should care, and the decision required.

Technical Analysis

• Security property:
• Preconditions and attack path:
• Trust boundary crossed:
• Reproduction in authorized environment:
• Evidence:
• Scope and affected versions:
• False-positive checks:

Risk

Distinguish likelihood, impact, exploitability, exposure, compensating controls, and uncertainty. Do not use a severity label as a substitute for analysis.

Remediation

• Immediate containment:
• Durable engineering fix:
• Detection/monitoring:
• Owner and due date:
• Validation test:
• Residual risk: