report-executive

To generate an executive risk report from pentest findings, this skill transforms validated security vulnerabilities into non-technical summaries by mapping technical severity to business impact categories like financial and operational risk. It requires integration with existing finding stores to produce accurate leadership briefs.

Mapping technical vulnerabilities to compliance frameworks like GDPR and HIPAA is achieved through regulatory mapping, which connects findings to specific legal requirements to highlight potential audit exposure. This process translates technical security flaws into clear compliance risks for stakeholders.

You cannot include raw proof-of-concept evidence in executive security summaries because the skill enforces strict redaction of sensitive evidence and secrets. It generates structured briefs featuring risk heat maps and remediation roadmaps without exposing raw proof to protect sensitive data.

Generating management risk summaries does require integration with existing finding stores and policy validation gates. This prerequisite ensures the executive brief accurately reflects confirmed vulnerabilities and safely normalizes the data into strategic reporting for leadership consumption.

Policy validation gates are needed before translating pentest reports into business risk to ensure accurate and safe reporting. They validate confirmed findings against established policies, preventing unverified vulnerabilities from being mapped to financial, operational, or reputational risk categories.

Risk normalization in security reporting is the automatic mapping of technical severity levels to business-impact categories such as financial, operational, and reputational risk. It bridges the gap between technical findings and business-level decision-making for leadership stakeholders.