Reports
Create a document from accumulated results for a security review, board update, or audit response.
Generating one
- Open Reports.
- Choose a scope: the whole organisation, a project, or a single model.
- Choose the period.
- Generate, then download.
The document is self-contained HTML: fonts, styles, and images are embedded, so it renders the same offline and in a mail client that blocks remote content. Print to PDF from any browser when you need one. The page rules are real, so pagination comes out right.
Technical and executive
| Technical | Executive | |
|---|---|---|
| Audience | Engineers and security staff | Leadership, risk, audit |
| Contains | Every finding, with location, exploitation detail, and remediation | Posture, trend, risk concentration, compliance mapping |
| Who can generate | Admin, Security Researcher, Developer | Admin and Executive |
Developers generate technical reports for their own scope. Executives cannot generate technical reports. That way, a board pack never accidentally includes exploitation detail.
What is in a report
- Cover: organisation, target, overall score, and period.
- Executive summary: the posture in prose.
- Scope and metadata: what was assessed, with the ruleset version and hash so the result is reproducible.
- Top risks: ranked, with severity, phase, location, and OWASP category.
- Severity distribution and OWASP breakdown.
- Findings: grouped by phase, with remediation.
- Remediation plan: prioritised, with effort.
Sections follow the data: a report covering only BUILD results contains no TEST or RUNTIME sections rather than empty placeholders.
Reading the scores
Scores are colour-banded, and the direction differs by metric. Overall score, BUILD score, and SDS are higher-is-safer. ASR is higher-is-worse. Full interpretation is on Scores & exit codes.
Sharing
Technical reports are sensitive
They describe exactly how to exploit your systems and, when a TEST run retained responses, may quote content the attack extracted, including your own system prompt. Share them as you would a penetration-test report.
Executive reports carry no exploitation detail and are the right artefact for a wider audience.
Generating from the CLI
secureai scan ./prompts --report assessment.html produces the same document from a single run, which is what you want as a CI artefact. The dashboard covers accumulated results across runs, models, and phases. See CLI reports.
Automating
For a recurring report, run the CLI on a schedule and collect the artefact. See CI integration. Headless Chrome converts it to PDF in the same job.
Compliance
Every finding carries an OWASP LLM Top 10 identifier, and the Compliance section maps posture against it. Where your organisation reports under a different framework, the OWASP mapping is usually the bridge. See OWASP LLM Top 10.