Executive Security Report
A PDF for managers and directors that shows how security stood in the previous period, what improved and which risks still need attention, generated on demand or emailed every month or quarter.
The Executive Security Report is a PDF written for managers, directors and CISOs. It answers three questions about a period: how security stood before, what actually improved, and which risks still need attention or a decision. It covers only the modules your organization has active and reads as plain prose, with the numbers that back each sentence.
You find it under Reports in the portal sidebar, right below Dashboard.
What the report contains
| Section | What it shows |
|---|---|
| Cover | Issues found and fixed in the period, issues open at the end of it, how many of those are past their fix deadline, and a severity bar. |
| Summary | Three short paragraphs and five indicators: issues found, issues fixed, typical time to fix, share of fixes made within the deadline, and open issues past the deadline. |
| Comparison | The period against the previous one, indicator by indicator, with the change marked as better, worse or stable. |
| Year so far | For quarterly editions, each quarter of the year side by side. |
| By area | Each security area you monitor (web applications, source code, repository libraries and secrets, supply chain, mobile applications, servers, cloud, leaked credentials), with monitoring and comparison status. |
| By severity | Found, fixed, open and past deadline for critical, high, medium and low issues. |
| Open issues | What was open on the last day of the period, per area and severity. |
| Types of issue | The kinds of problem found in each area. |
| Next steps | Up to six actions taken from the data, such as resetting leaked passwords or fixing injection issues first. |
| Method | How every number was calculated and what was monitored. |
The report contains only counts, rates and durations. It never includes a URL, a hostname, a repository name, a person or a secret, so a forwarded copy reveals your overall posture and nothing an attacker could use.
Generate a report
- Open Reports.
- Choose a Period: last quarter, quarter to date, last month, month to date, year to date, or a custom range of up to 366 days.
- Select Generate report. The page follows the generation and refreshes when the PDF is ready, usually within a minute.
- Download it from History.
Each period is compared with the previous period of the same length. A period still running, such as quarter to date, is compared with the same number of days at the start of the previous quarter, so a partial period is never set against a full one. Year to date has no comparison.
One report is generated at a time for the whole organization, and each person can generate up to 20 reports a day.
Language
The report is written in the language set for Reports in Settings > AI & Language: English, Portuguese (Brazil) or Portuguese (Portugal). The Portuguese (Portugal) edition has its own wording, not a conversion of the Brazilian one. Other languages chosen in that tab produce the report in English. The portal screens stay in English.
History
Every edition is kept exactly as it was generated, so the report of August stays the report of August even after findings change. History shows the period, the type, the language, who generated it and its status. Editions are kept for 13 months.
Organization name and time zone
The report prints your organization name on the cover and in the page header. Every period and every scheduled email follow the time zone of the organization's first Admin, set in Settings > System settings: this is the report time zone. Reports shows the time zone in use and whose Settings it comes from.
Scheduled delivery
The report can reach leadership by email without anyone opening the portal.
| Delivery | When it is sent | What it covers |
|---|---|---|
| Monthly | First business day of each month, at 08:00 in the report time zone | The month that just closed |
| Quarterly | First business day after each quarter closes, at 08:00 in the report time zone | The quarter that just closed |
For each delivery an Admin chooses:
- Recipients: up to 20 members of the organization. Only members who can view reports appear in the list, and each one is checked again at every send: a person who left the organization, was deactivated or lost access to reports is skipped.
- Format: the PDF attached to the email, or a link only. With a link, the recipient signs in to download the report.
- Send automatically: turns the delivery on or off.
Send now generates the latest closed period and emails it right away, at most once an hour. It also works while the delivery is off, so you can check the email before turning it on.
New organizations start with the monthly delivery turned off and their Admins already selected. The organization dashboard shows Activate your monthly executive report to Admins until someone turns it on. Nothing is emailed before an Admin activates a delivery.
A recipient who no longer wants the email can open Reports and choose Stop sending to me.
Who can do what
| Action | Admin | Manager | Analyst | ReadOnly |
|---|---|---|---|---|
| Open Reports, see History and download editions | Yes | Yes | Yes | Yes |
| Generate a report | Yes | Yes | Yes | No |
| Change scheduled deliveries and use Send now | Yes | No | No | No |
| Stop receiving a scheduled report | Yes | Yes | Yes | Yes |
A partner operating your environment can generate and download reports but cannot change scheduled deliveries. A ReadOnly account is the recommended way to give a director access to the reports without operational rights.
How to read the numbers
Comparisons respect coverage. An area enters the comparison only when it was monitored in both periods and its coverage changed by less than 25 percent: targets scanned for web applications, repositories analyzed for code and libraries, applications assessed for mobile, servers reporting for infrastructure, cloud accounts synchronized for cloud, and verified domains for leaked credentials. An area whose monitoring started or grew in the period shows its own numbers and the reason it is left out of the comparison, so more assets or more scans are never read as better or worse security.
New detection is not read as change. When WASViking widens what it detects in an area during the compared periods, for example by adding new data sources, that area stays out of the comparison and the report says so, so newly found issues are not read as worse security. When only some areas can be compared, the report names them. A change from a previous value below 10 is shown as a difference, such as +363, instead of a percentage.
Unavailable is never zero. When a number cannot be calculated or compared, the report prints n/a and explains why in the method section. Typical reasons: nothing was fixed in the period, there is no data for the previous period, or the area does not yet have verified fix counts.
Fixed means confirmed. In most areas an issue counts as fixed when a new test stops finding it. Issues closed by a person, in the portal or by closing the linked ticket in your ticketing tool, are counted as closed by the team. Accepted risk is always reported apart from fixed issues.
Some fix counts wait for verification. Where WASViking cannot yet confirm fixes with a new test for an area, its fix counts and fix times show as n/a and the report says so. Found, open and past deadline counts are still shown for that area.
Deadlines. Each issue gets a fix deadline by severity, from your organization's SLA policy (by default 7 days for critical, 30 for high, 60 for medium and 90 for low). Informational issues and server vulnerabilities without an official rating have no deadline.
Typical time to fix is the median: half of the issues were fixed faster than that. The report also shows the mean and the time within which 90 percent of the issues were fixed.
Percentages near the ends. A share shows 100% only when every item met it and 0% only when none did, so 99.5% stays 99.5%.
Libraries whose version could not be identified are listed as their own type. WASViking could not tell which version is in use, so it could not check the library against known vulnerabilities. They are informational and have no deadline. Adding a lockfile, or a software bill of materials generated by your build, to the repository usually lets the version be identified.
Frequently asked questions
Why does the comparison say the period stands on its own? No area was monitored in a comparable way in both periods, for example because several modules were activated during the period. The next edition compares normally once coverage is stable.
Why do the numbers differ from the Findings page? The Findings page shows the current state of every finding. The report counts what happened inside the period and what was open on its last day.
Can I change the language of one report only? The language follows Settings > AI & Language. Change it there before generating the report, and change it back afterwards if needed.