Sample report

See how Unit 91 reports risk and remediation.

Below is a redacted excerpt from one finding in a real report. The full report, with the client and their systems redacted, is a form away.

From a real report

One finding, as a redacted excerpt.

High

Temporary pre-MFA token accepted as a full credential

Classification: CWE-863 Incorrect Authorization

Impact

An attacker holding a user's password could present the short-lived token issued before the second factor, and have it accepted as a fully authenticated session. That allowed replacing the victim's registered authenticator, invalidating the original device, and holding persistent access to the account. The control intended to contain password compromise did not contain it.

Remediation

Separate temporary MFA tokens from access tokens by type, reject temporary tokens at every endpoint that is not the MFA challenge itself, and require a fully authenticated session with re-authentication before any authenticator change.

How the grade works

Every report carries one overall grade from A to F. It is set by the most severe confirmed finding within the tested scope and period, so it describes what we demonstrated in that engagement, not the organisation as a whole, and it is not a badge anyone awards.

This finding set its engagement's initial grade at D. All 7 findings were closed at retest. Read the case study for the full picture, including what was tested for and not found.

This is a redacted excerpt. Omitted from the public preview: the client and every identifier, the CVSS vector, the affected endpoints, the reproduction steps and the evidence. The title, classification, impact and remediation are as reported.

What is in it

A full engagement, start to finish.

Executive summary
A plain-language account of the risk position, written for the people who will not read the technical section.
Overall security grade
A single grade derived from the most severe confirmed finding, using the thresholds set out in the report rather than a gut call.
Detailed technical findings
Every finding with its CVSS vector, CWE classification, affected endpoints and full reproduction steps.
Proof-of-concept evidence
Requests, responses and screenshots demonstrating that each finding is real rather than inferred.
Remediation recommendations
Specific, written against your stack, and ranked by exploitability, business impact and what has to be fixed first. Not a link to a vendor advisory.
Retest summary
Issued after remediation, confirming what is fixed and what remains outstanding.

Request the full report

Name, work email and company are all we need. The report is a redacted version of real client work, so we confirm who you are before sending it, which usually takes less than a business day. No mailing list.