# Vulnerability scanning report template

Original SecNet teaching template. All examples are fictional. Do not put secrets in this file.

v1.0 / 2026-10-20

This is a practical guide; it does not connect to targets or launch scans. A real engagement defines written asset-owner authorization, explicit scope, a maintenance window and stop conditions.

## Scope and authorization

Targets, exclusions, owner, source IP, window, stop threshold and approval reference.

[Complete]

## Method and visibility

Internal/external view, sensor, profile/feed version, authentication success and untested areas.

[Complete]

## Executive summary

Business impact, prioritized decisions, coverage gaps and required resources.

[Complete]

## Technical finding

ID; asset; CVE/CWE if applicable; CVSS version/vector; redacted evidence; validation; exposure; business impact; owner; due date.

[Complete]

## Remediation and exceptions

Change reference, mitigation, justified risk acceptance, accountable approver and expiry.

[Complete]

## Retest and closure

Before/after evidence, same viewpoint, technical result, service check and closure decision.

[Complete]

## Worked fictional example

An external sensor reaches an unexpected management port on 203.0.113.20. The address is fictional.

First confirm ownership and that the service really is a management interface. Do not label an open port as a breach or confirmed CVE.

Restrict internet reachability to required sources, and review strong authentication and patch status. Retest from the external sensor.

## Sources

- NIST SP 800-115: https://csrc.nist.gov/pubs/sp/800/115/final
- NIST SP 800-82 Rev. 3 · OT: https://csrc.nist.gov/pubs/sp/800/82/r3/final
- Nmap reference: https://nmap.org/book/man.html
- Greenbone Community documentation: https://greenbone.github.io/docs/latest/22.4/container/index.html
- Tenable · credentialed checks: https://docs.tenable.com/nessus/Content/CredentialedChecksOnWindows.htm
- ZAP · baseline scan: https://www.zaproxy.org/docs/docker/baseline-scan/
- PortSwigger · running scans: https://portswigger.net/burp/documentation/desktop/running-scans
- ProjectDiscovery · Nuclei: https://docs.projectdiscovery.io/opensource/nuclei/overview
- Trivy documentation: https://trivy.dev/docs/latest/guide/
- Qualys VMDR: https://www.qualys.com/apps/vulnerability-management-detection-response
- FIRST · CVSS: https://www.first.org/cvss/
- FIRST · EPSS: https://www.first.org/epss/
- CISA · KEV official mirror: https://github.com/cisagov/kev-data