Eleven findings, not three hundred
The scanner returned 312 entries over the same scope. Eleven reached the report. The other 301 sit in an annex with the reason each was discarded, so the criterion can be audited rather than taken on trust.
Sample report
The report is the product
Everything else — the weeks of operation, the tooling, the technical skill — exists to produce this document. If the report does not serve you, the engagement will not either. So here it is in full, with no form and without leaving your email address.
Contents
The ten pages
A real red team report runs between forty and eighty pages. This sample keeps one page from each section, which is what lets you judge the reasoning without reading the full volume.
- 01Cover and engagement record
- 02Executive summary for the board
- 03Scope and rules of engagement
- 04Operation timeline
- 05Attack chain and the cost of breaking it
- 06Critical finding with evidence
- 07Findings inventory
- 08SOC traceability table
- 09Prioritised recommendations
- 10What this sample is and is not
Differences you notice while leafing through it
Evidence
Detection
82% never reached a rule
The traceability table maps every offensive action against what the SOC saw. That percentage, not the finding count, is the metric worth tracking between one exercise and the next.
Honesty
It states what it did not measure
The closing section lists the limits of the exercise. A red team walks one route; it does not exhaust the risk, and a report that fails to say so is selling certainty where there is only evidence.
Criteria
What you should be able to judge from it
You do not need to be technical to evaluate a security report. These five questions separate a useful document from scanner output with a nice cover.
- Whether the executive summary holds up before a board without anyone translating it.
- Whether each finding carries enough evidence for your team to reproduce it without calling the author.
- Whether prioritisation reflects your real exposure or a score copied from a catalogue.
- Whether the document clearly separates what was observed, what was inferred and what is opinion.
- Whether the traceability table is of any actual use to the team that has to improve detection.
About this sample
The document reproduces the structure, layout and drafting criteria of a real report, but the entity, systems, dates and findings are fictional and were built for this sample. I do not publish anonymised real reports: the combination of sector, size and architecture identifies an organisation even with names redacted, and that would be incompatible with the confidentiality agreement I sign before the first technical conversation.
FAQ
Frequently asked
Why is there no email gate?
Because putting a form in front of it would contradict the rest of this site, which uses no cookies, no analytics and no third-party resources. If the report is useful to you, you know where to find me; and if it is not, there is no reason for me to hold your address.
Is this a real client report?
No. It is a sample built for this website, with a fictional entity, systems and findings, and it is labelled as such on every page. It reproduces the structure and drafting criteria of a real report, which is what can be judged; it does not reproduce any specific engagement.
How long is a real report?
Forty to eighty pages for a nine-week red team, plus evidence annexes and the full traceability table, which can exceed five hundred entries. This sample keeps one page from each section.
Does this format work for you?
If the report answers what your organisation needs to be able to show, the next step is a thirty-minute conversation about scope.