Skip to article frontmatterSkip to article content
Site not loading correctly?

This may be due to an incorrect BASE_URL configuration. See the MyST Documentation for reference.

Severity alone does not determine priority. Risk-based reporting connects technical vulnerabilities to business impact. This module teaches you to think beyond “High, Medium, Low” and instead communicate in terms executives understand: risk exposure and risk reduction.

Prioritisation for Managers and CEOs

Translate Technical Risk into Business Impact

Instead of:

“Improper deserialisation allows arbitrary object instantiation.”

Say:

“An attacker could gain full control of our customer data platform.”

Focus on:

Risk-Based Prioritisation Model

Combine:

Example categories:

PriorityDescription
CriticalInternet-facing, exploitable, sensitive data exposure
HighPrivileged access required but significant impact
MediumLimited exposure or partial impact
LowDefence-in-depth or hard-to-exploit

Provide:

Developer-Friendly Feedback

Security testing should enable developers, not antagonise them.

Principles:

Good Developer Feedback Example:

Instead of:

“Input validation is broken.”

Provide:

Example:

Issue: Direct string interpolation in SQL query.

Fix: Use parameterised queries.

# Vulnerable
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# Secure
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

Developers appreciate:

Driving Remediation

Reporting is only the beginning. Effective testers ensure findings are resolved. Recommended Follow-Up Strategies:

  1. Remediation Tracking

  1. Retesting

  1. Remediation SLAs

  1. Trend Analysis

  1. Security Enablement

  1. Executive Reporting Dashboards

Key Takeaways

Effective reporting:

Mastering Security Testing for Python
Using CVSS
Mastering Security Testing for Python
Module 9