Cyber Security Academy · Lesson

Writing Findings

Clear, actionable findings.

Writing Findings is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Makes a Good Finding

A finding is the unit of value in a pentest report. A good finding is clear, evidence-backed, and actionable.

The reader should understand the problem, believe it is real, and know what to do, all from one entry.

The Finding Template

Use one consistent template for every finding. Consistency builds trust and makes findings comparable.

Each finding has the same fixed sections.

Finding fields:
  Title | Severity | Affected Assets
  Description
  Steps to Reproduce
  Impact
  Remediation
  References (CWE/OWASP)

Writing the Title

The title should name the vulnerability class and location in a few words. It is the first thing a reader scans.

Good: SQL Injection in Login Form
Weak: Database Issue

Be specific, not vague.

Description: What and Why

The description explains what the flaw is and why it exists, in two or three sentences. Assume a competent engineer who has not seen the bug.

State the root cause, not just the symptom.

The login endpoint concatenates the
username directly into a SQL query
without parameterization, allowing an
attacker to alter the query logic.

Steps to Reproduce

List exact, numbered steps to reproduce. Anyone on the team should be able to follow them and see the same result.

Include the request, payload, and observed response.

1. Browse to /login
2. In the username field enter: admin'--
3. Enter any password
4. Submit the form
5. Observe: logged in as admin

Showing Impact

Impact answers the question every executive asks: so what? Translate the technical flaw into business consequences.

Full read access to the user database.
Authentication bypass for any account.
Potential regulatory breach.

Avoid Speculation

State only what you demonstrated. If you did not extract data, say the flaw allows data extraction, not that you exfiltrated records.

Mark unverified theories clearly as potential, not confirmed.

Evidence That Convinces

Attach the minimal evidence that proves the finding: a request/response pair or an annotated screenshot.

Redact secrets and real personal data. Evidence builds credibility; bloated evidence buries the point.

Request:  GET /api/users?id=1 OR 1=1
Response: [array of 4,812 user records]
          (sample redacted)

Reference Standards

Link each finding to a recognized classification such as CWE or the OWASP Top 10.

References let the client research the issue independently and show your work is grounded in standards.

References:
  CWE-89  Improper Neutralization of SQL
  OWASP A03:2021 Injection

Write for the Reader

Use active voice, short sentences, and no unexplained jargon. Define an acronym the first time you use it.

Remember the dual audience: the summary lines must make sense to a manager, the steps must satisfy an engineer.

Common Mistakes

Avoid these frequent finding-writing errors.

Copy-pasting raw scanner output as a finding.
No clear impact statement.
Steps that cannot be reproduced.
Inconsistent severity across similar issues.

Quick Check

Test your understanding of writing findings.

Recap

You learned to write clear, actionable findings.

Use one consistent template for every finding.
Specific titles, root-cause descriptions, numbered repro steps.
Translate flaws into business impact.
State only what you demonstrated; redact evidence.
Link to CWE and OWASP references.

Next you will learn how to give effective remediation guidance.

Frequently asked questions

Is the “Writing Findings” lesson free?

Yes — the full text of “Writing Findings” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Writing Findings”?

Clear, actionable findings. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Writing Findings” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy