How a finding is written
Each product writes its own report. Both use the same severities, weakness classes and layout, so one team can read both, and compare them.
Rules, reports and mappings to standards can be adapted to your needs, and to the regulations of your country or region.
- Severity: critical, high, medium, low or info
- Weakness class: its weakness type (CWE (Common Weakness Enumeration. The common list of software weakness types.))
- Evidence: what shows it is real
- What to change: the fix, in plain words