Cybersecurity & InfoSec Consulting

Write an executive summary for a security assessment report. Client: [COMPANY NAME]. Assessment type: [TYPE: e.g., external pentest, internal network assessment, web application assessment, red team exercise]. Assessment period: [DATES]. Overall risk rating: [CRITICAL / HIGH / MEDIUM / LOW]. Top 3 findings: [LIST WITH SEVERITY]. Key business risks identified: [LIST]. Structure: (1) Assessment overview (what was tested, when, by whom — 2 sentences), (2) Overall security posture (one honest paragraph — what the assessment revealed about the organization's security maturity), (3) Critical findings (top 3 — each described in business impact terms, not technical terms), (4) Risk to the business (what these findings mean for operations, data, reputation, compliance — not CVE numbers), (5) Recommended priorities (3 actions, ordered by risk reduction impact). Length: 1 page. Audience: C-suite and board — no technical jargon without plain-language explanation. Tone: direct, credible, actionable — not alarmist.

Write a vulnerability finding for a penetration test report. Finding title: [TITLE]. CVSS score: [SCORE]. Severity: [CRITICAL / HIGH / MEDIUM / LOW / INFORMATIONAL]. Affected system/component: [DESCRIBE]. Vulnerability description: [TECHNICAL DESCRIPTION]. Proof of concept: [DESCRIBE WHAT WAS DEMONSTRATED — no actual exploit code]. Business impact: [WHAT AN ATTACKER COULD DO WITH THIS — in business terms]. Remediation: [SPECIFIC FIX]. References: [CVE, CWE, or vendor advisory if applicable]. Structure each section clearly. Technical description must be precise enough for a developer to understand the root cause. Business impact must be written for a non-technical manager. Remediation must be specific — not "patch the system" but the exact configuration change, code fix, or vendor update required. Include estimated remediation effort: [LOW / MEDIUM / HIGH].