Sample vulnerability scan report

Customer reports are confidential. This sample therefore covers dvwa.cloud, a practice environment run by Hasecon and deliberately configured to be vulnerable, so it contains findings from critical to informational. The 36 findings come from a real scan at level 3 of 4; that number applies to this environment. IP addresses have been removed and long observations and evidence lines shortened. Each type of finding lists its source: the scan module and the time of measurement, or the rule it was derived from. The report is digitally sealed with a timestamp from an independent service. With Exposentry's public certificate, a recipient can check whether anything has changed since it was sealed. The scan level of your package is shown on the pricing page.

What it contains

The report opens with a management summary and then describes the scope, the method and the risk classification, with an overview by severity and a root-cause analysis. Then come the attack surface, with the open ports and what was left out of scope, and an indicative link to compliance. Almost every type of finding has the severity, the explanation, the source and a recommendation, and where applicable the observation with evidence, the KEV and EPSS data and the frameworks (ISO 27001, OWASP, CIS Controls and NIST CSF). It closes with the test coverage (WSTG and CIS), the tools used, the conclusion with next steps and an accountability section. What an external scan measures and where it stops is explained on the vulnerability scan page.

Sealed on October 27, 2026 at 10:37 PM UTC · SHA-256 of the file: 2c7a22032ffc74b1a0634a55e30abb7ef207ab8b8f89317c33566c5f0029f32b