See exactly what your CREST report will look like , before you commit.
Three real, redacted reports from a recent UK engagement: one for your developers, one for your leadership team, and one for public distribution. No demo call. No sales follow-up sequence. Just the deliverable.
Which sample report do you want?
Each category ships with all three tiers (Technical, Management, Public). Click a category, then submit the form below and download instantly.
Get the [pick a category] sample reports.
Fill in three fields and you’ll get the Technical, Management, and Public reports for the category you picked. Instant download, no email round-trip.
Get the sample reports
Three fields. Reports unlock immediately.
One engagement. Three audiences. Three reports.
Every EJN Labs engagement produces three distinct reports, each tuned to a specific reader. Hand the right one to the right team. No manual extraction.
Technical
For DevelopersThe full forensic record. Every finding with proof-of-concept request/response, CVSS 3.1 vector, exploitation chain, and a remediation block your engineers can action against the codebase.
- HTTP request / response evidence + exploit chain
- CVSS 3.1 base + temporal scoring
- Code-level remediation (snippets where relevant)
- OWASP / CWE / MITRE ATT&CK references
- Reproduction steps for retest verification
Management
For ExecutivesBusiness risk in plain English. What was tested, what we found, what it means for the company, and how long it’ll take to fix. Designed to brief a CISO, CTO, or audit committee in 10 minutes.
- Executive risk summary & heat map
- Business-impact narrative per finding
- Remediation timeline & effort estimate
- Compliance mapping (ISO 27001, SOC 2, PCI DSS)
- Trend comparison vs. previous engagements
Public
For DistributionA safe-to-distribute proof of testing. Contains the methodology, scope, attestation, and severity counts, but no sensitive technical detail. Share it in an RFP response without a redaction round.
- Scope, methodology & standards followed
- Severity counts & remediation status
- CREST attestation page (signed)
- Zero PoC, zero technical detail. Fully sanitised
- Co-brandable on request
Every report ships with six structured sections.
Whatever the category, every CREST engagement we run produces the same six-section structure. Here is what each section contains and which audience reads it.
Risk Summary & Executive Overview
A heat-map of every finding by severity, the business-context narrative behind each one, and a one-page version your CISO or audit committee can read in five minutes.
Approach, Scope & Caveats
Exactly what was tested (and what was not), the methodology applied, the time-box, and any limitations identified during the engagement.
Findings Summary with CVSS
Every issue scored on CVSS 3.1 base and temporal vectors, ranked by severity. Includes the affected assets list and a prioritised fix order.
Technical Detail per Finding
HTTP request and response evidence, the exploitation chain walkthrough, proof-of-concept payloads, and reproduction steps for retest verification.
Remediation Guidance & Timelines
Code-level fixes where relevant, vendor patch references, secure configuration examples, and an effort estimate per finding.
Compliance Mapping
Findings cross-referenced against OWASP Top 10, CWE, MITRE ATT&CK, ISO 27001, SOC 2, and PCI DSS for direct insertion into your audit packs.
This is exactly what a finding looks like in the technical report.
Every issue we surface comes with this level of evidence: vector, scoring, reproduction steps, and remediation a developer can ship by end of sprint. No vague “consider hardening” language.
Are these reports from a real engagement?
Yes. The bundle is a real engagement we delivered in April 2026, fully redacted. Names, IPs, hostnames, customer references, and any sensitive technical detail have been replaced. Severity counts, methodology, formatting, and remediation language are unchanged.
Why three reports per engagement?
Because three audiences need three things. Engineers need PoC + remediation. Executives need risk + business impact + timeline. Auditors and customers need attestation + counts without exposing internals.
Will I be added to a sales sequence?
No automated sequence. We just notify our team that you downloaded so we can answer questions if you reply. We don’t send marketing follow-ups.
Can I share the Public report with customers?
That’s exactly what it’s for. The Public report is sanitised to zero technical detail and includes a CREST attestation page. Many of our clients pass it through to enterprise prospects in RFP responses and SOC 2 evidence packages.
What format are the reports?
PDF. Roughly 35–80 pages depending on the service. Branded, formatted to print on A4, navigable via internal links and bookmarks.
Take the deliverable for a test drive.
Three reports, three fields, instant download. Have a look at the format you’d receive. Then decide whether to talk to us.
