OpenVAPTReporting and Communication
What a good assessment report contains, how to read OpenVAPT's report, and how to share results safely.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/a3.html. Offline: openvapt learn A3.
Read First: A2
You Will Be Able To
- Describe the structure of an assessment report.
- Explain why limitations belong in every report.
- Share reports without leaking sensitive information.
Structure
NIST SP 800-115 recommends scope and methodology first, then findings with severity, evidence and remediation, then limitations. OpenVAPT reports follow that order and come in HTML, JSON, SARIF 2.1.0 and Markdown.
Honesty in Reports
An honest report says what was not tested. Limitations protect readers from false confidence and protect the author from overclaiming. OpenVAPT never issues a seal, score or certificate.
Sharing Safely
A report describes weaknesses of a real machine. Share it only with people who need it, and review it for remaining secrets first. Sign it (the default) so recipients can use openvapt verify to confirm it was not edited.
In Summary
A report serves its reader. Lead with what matters, give evidence and say what was not tested. SARIF and signing make it machine readable and tamper evident.
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Open a sample report on openvapt.com and identify scope, methodology, findings and limitations.Run: openvapt verify a1/report.json, then edit one character in the file and verify again.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). A3: Reporting and Communication (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a3.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_a3,
author = {{OpenVAPT}},
title = {{A3: Reporting and Communication}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/a3.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.