B7: Professional Delivery & Capstone
Reporting Deep: CVSS v4, Attack Chains & Executive Risk
Turn technical findings into severity, narrative, evidence, and remediation decisions.
- Use CVSS v4 as a structured scoring model, not a substitute for judgment.
- Write attack chains when multiple medium issues combine into critical impact.
- Separate evidence from interpretation: request/response, screenshots, logs, and exact affected assets.
- Give remediation by owner: developer fix, IAM fix, network fix, monitoring fix, and process fix.
- Include detection opportunities so defenders can monitor while engineering fixes land.