Sample report

What you'd actually get.

Every assessment ends with two documents: a one-page Security Snapshot you can read in ninety seconds, and a full report with the evidence behind it. Below is the Snapshot for a made-up two-person bookkeeping firm, followed by an excerpt from its website findings — the structure, the tone, and how honestly things are rated.

Security Snapshot — Alder & Finch Bookkeeping

Prepared for: Alder & Finch Bookkeeping (fictional) · Contact: M. Alder, owner
Prepared by: Bryan, The Clauditor · Date: 2026-10-20 (sample)
Assessment window: 2026-10-13 to 2026-10-17 (sample) · Authorization: AUTH-SAMPLE-001, signed 2026-10-10 (sample)

The short version

We looked at the firm's public footprint (alderfinch.example and its mail), the website, the two Macs and two phones the partners work from, and the accounts behind them. Overall, Alder & Finch is in fair shape: a reputable mail provider and encrypted laptops are already in place, and nothing we found puts money or client files at immediate risk. The single most important thing to do first is turn on hardware security keys for the two Google accounts and the recovery address behind them — the firm's client files, mail and bank sign-ins all hang off those accounts.

Below is what's already working, the handful of things worth fixing, and where we'd start.

What's strong

  • Mail runs on Google Workspace with two-step verification on both partner accounts — the single biggest protection a small firm can have is already on.
  • Both laptops are encrypted (FileVault) and on the current macOS — a lost laptop is an inconvenience, not a breach.
  • The website is served over HTTPS only, with a current certificate and TLS 1.3, and no exposed backup, configuration or source-control files were found.

Top things to fix

# What to fix Severity Effort The one-line fix
1 Mail can be forged to look like it's from alderfinch.example (DMARC is published with no enforcement) High Quick Move DMARC to quarantine, then reject, after a two-week read of the reports — we set it up and read them with you.
2 The partners' second factor is a text message, and the recovery address is a personal mailbox with no second factor High Moderate Enroll hardware security keys on both Workspace accounts and the recovery mailbox; retire text-message codes.
3 A bookkeeping add-on the firm stopped using in 2025 still holds read/write access to the firm's Google Drive High Quick Revoke the grant in the Workspace admin console — minutes — and review the rest once a year.
4 The website's contact form collects personal details on a page without browser-protection headers (no HSTS, no Content Security Policy, no frame protection) Medium Quick Add the standard security-header set at the host — a one-time change we make and verify.
5 The only backup of the firm's working files is the sync folder itself — a deletion or a ransomware event would sync to every copy Medium Moderate Add a versioned, encrypted off-site backup that keeps 30 days of history, and test a restore.

Severity & effort, in plain terms

Severity What it means Effort What it means
Critical Act now — money/identity at direct risk Quick Minutes; often we do it on the spot
High This week Moderate About an hour or a guided session
Medium This month Project Ongoing or needs a vendor
Low This quarter
Info Good to know

Your next step

A two-hour remediation session: we enroll the keys, revoke the stale grant and set DMARC to quarantine together, then schedule the header change and the backup. We can do the work for you, walk you through it, or hand you a checklist — your call.

The Clauditor · theclauditor.ai · Confidential — prepared for Alder & Finch Bookkeeping · 2026-10-20 (sample)

This snapshot summarizes a fuller assessment. The complete findings, evidence, and the scope and authorization on which they rest are in the full report. It reflects the systems in scope during the assessment window; it is a point-in-time picture, not a guarantee of future security.

From the full report: two website findings

The full report carries, for each finding: what it is, what we found (the evidence), why it matters, the fix, severity, effort, and the OWASP Top 10:2025 category. Two rows from the sample:

Finding What it is What we found (evidence) Why it matters Severity Effort Recommended fix OWASP
Missing security headers Standard HTTP headers that tell the browser how to protect your visitors curl -sI https://alderfinch.example/ shows no Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options or frame-ancestors (sample evidence) Leaves visitors more exposed to script injection, clickjacking and downgrade attacks; cheap to fix Medium Quick Add the security-header set at the host; we make the change and verify it. A02
Verbose version banners Server and framework version strings advertised in responses Server: Apache/2.4.x · X-Powered-By: PHP/8.x (sample evidence) Helps an attacker match your software to known exploits Low Quick Suppress the server tokens and the X-Powered-By header. A02

Scope & method (sample)

What we assessed. The website at alderfinch.example: server and stack fingerprint, TLS posture, HTTP security headers, cookies, exposed sensitive files, content-system posture, the contact form and the personal data it collects, and third-party trackers — against OWASP Top 10:2025, ASVS 5.0 and WSTG.

How we assessed it. A passive-first pass over what the site already serves to the public, followed — only inside the signed authorization — by authorization-gated path checks and an active TLS scan, tagged as such in the evidence. We read; we did not exploit.

What we did not assess. The bookkeeping platform itself (a vendor's system), the bank portals, and any host not named in the authorization.

Authorization. AUTH-SAMPLE-001, signed by M. Alder, naming alderfinch.example and the four devices. No system outside that scope was probed.

Evidence & retention. Redacted header blocks and status lines — never a secret, a token or real personal data — held in the engagement's encrypted store for 90 days after delivery, then destroyed.

What a real report has that this sample doesn't: the evidence exhibits (redacted screenshots and command output), the full findings list, and the client's own strengths — which are always specific, never "good job".