---
title: "A3: Reporting and Communication"
canonical: https://openvapt.com/academy/a3.html
html: https://openvapt.com/academy/a3.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A3: Reporting and Communication

What a good assessment report contains, how to read OpenVAPT's report, and how to share results safely.

- Level: Applied
- Time: about 15 minutes
- Read first: A2

## You Will Be Able To

- Describe the structure of an assessment report.
- Explain why limitations belong in every report.
- Share reports without leaking sensitive information.

## Structure

NIST SP 800-115 recommends scope and methodology first, then findings with severity, evidence and remediation, then limitations. OpenVAPT reports follow that order and come in HTML, JSON, SARIF 2.1.0 and Markdown.

## Honesty in Reports

An honest report says what was not tested. Limitations protect readers from false confidence and protect the author from overclaiming. OpenVAPT never issues a seal, score or certificate.

## Sharing Safely

A report describes weaknesses of a real machine. Share it only with people who need it, and review it for remaining secrets first. Sign it (the default) so recipients can use openvapt verify to confirm it was not edited.

## In Summary

A report serves its reader. Lead with what matters, give evidence and say what was not tested. SARIF and signing make it machine readable and tamper evident.

## Lab

1. `Open a sample report on openvapt.com and identify scope, methodology, findings and limitations.`
2. `Run: openvapt verify a1/report.json, then edit one character in the file and verify again.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Why should a report list its limitations?
   - A. To make it longer
   - B. So readers do not mistake absence of findings for proof of security
   - C. To hide findings
   - D. So the report can claim compliance
   - Answer: B. Honest limits prevent false confidence and stop the author overclaiming.

2. What does a valid report signature prove?
   - A. The machine is secure
   - B. The report was not edited after signing
   - C. The project endorses the report
   - D. Every finding is real
   - Answer: B. A signature proves integrity only, never security.

3. Which order does NIST SP 800-115 recommend for a report?
   - A. Scope and methodology, then findings, then limitations
   - B. Findings first, then scope
   - C. Limitations only
   - D. An overall score, then a seal
   - Answer: A. Readers first learn what was tested and how, then what was found, then what was not covered.

4. Before sharing a report, what should you do?
   - A. Post it publicly for transparency
   - B. Review it for remaining secrets and share it only with people who need it
   - C. Remove the signature
   - D. Delete the limitations
   - Answer: B. A report describes weaknesses of a real machine, so share it carefully.

5. Does OpenVAPT issue a security seal, score or certificate?
   - A. Yes, after a clean scan
   - B. No, never
   - C. Only when there are no Critical findings
   - D. Only for signed reports
   - Answer: B. OpenVAPT never issues a seal, score or certificate, because no scan proves security.

## Key Terms

- SARIF: Static Analysis Results Interchange Format: an OASIS standard JSON format for tool findings.
- Limitations: A report's honest statement of what was not tested or could not be determined.
- Report Signing: Adding a digital signature to a report so recipients can confirm it was not edited.

## References

- [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)
- [OASIS SARIF 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html)

Offline: `openvapt learn A3`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a3.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.