Live Reporting: Showing a Client Findings as You Find Them

A client paying for a two-week test does not want to wait two weeks to hear that their admin interface is open to the internet. Live reporting means they hear as soon as you know, in the portal, without a phone call that skips your process or a half-written PDF sent by email. The finding they see is marked as a draft, and the report itself stays exactly as controlled as it always was.

Drafts, by default

A finding is a draft when it is marked as one, or when a field your firm requires is still empty. New findings start as drafts unless you change New findings are saved as under Settings, Findings, so a tester never has to finish a write-up before getting back to the test.

In the finding dialog, Save as draft and close records it as it stands, and Save as final and close finishes it, asking for any required field first. Which fields are required is your choice, field by field, on the same settings screen.

Showing it to the client

Every finding has a Client Visible switch on the engagement. Turn it on and the client sees the finding in their portal straight away, with a Draft mark beside it until your write-up is final. For a high or critical finding the switch asks first, with Show and email beside Show, don’t email, because those are the ones somebody should hear about now. (That email is one you can switch off, under Settings, Notifications.)

Several findings can be shown together: tick them, on the engagement or on the Findings page, and press Show to client on the bar that appears. Nobody is emailed when findings are shown that way.

What the client sees

A draft finding reads to the client as exactly what it is: found, rated and described, and still being written. They can talk to your team about it on the engagement itself, in its comments, rather than by email. Anything you have not switched on stays out of their portal altogether; your database does not hand it to their login.

Nothing unfinished goes out

Drafts go through QA like any other finding, and the review says how many came with the report. What they cannot do is be signed off or reach the client. Approving a report with anything still marked as a draft, a finding or a section of the report, stops at a list titled Not ready to approve, and delivering one at Not ready to deliver: each draft with what keeps it one, Fix to open it at the first empty field, and Mark as final for one that is complete and only marked. Once nothing is left, the approval or the delivery carries on.

A report only counts as ready to deliver while everything in it is final. If a finding is added or marked as a draft after the report was approved, it leaves the lists of reports ready to go, and the QA queue keeps it under Approved with drafts to finish.

The same rule covers the report’s written sections. The executive summary and the report’s sections explains marking one as a draft.

When to use it

Live reporting earns its keep on critical findings, on long engagements, and with clients whose teams want to start fixing on day two rather than week three. For the conversation around a serious issue found mid-test, see reporting a critical finding during a penetration test. For what the client sees around it, what your clients actually see in the portal.