Skip to main content
Reports turn the data collected from your attack surface — assets, vulnerabilities, and their trends — into structured documents that stakeholders can act on. Whether the audience is management, auditors, or compliance reviewers, OASM Reports let you generate consistent, repeatable outputs instead of assembling findings by hand. Reports are generated from workspace data on demand. A preview-before-generate workflow lets you inspect the output before committing a report, so you never generate a document you have not seen.

​
Report types

  • Summary report — a workspace-wide posture overview. It aggregates statistics, highlights the top vulnerabilities, summarizes TLS/SSL status, and shows asset trends over time. Use it for regular executive updates and high-level compliance reporting.
  • Vulnerability report — a per-vulnerability breakdown. For each finding it covers the description, the affected asset (URL and ports), risk analysis, and remediation steps. Use it to drive remediation sprints and document audit evidence.
Choose Summary when the goal is a posture snapshot: leadership briefings, recurring status updates, and program-level compliance summaries. Choose Vulnerability when the goal is action: remediation sprints, audit evidence for a specific finding, or handoff to the team that fixes the issue. A common rhythm is a weekly summary for management plus vulnerability reports whenever a critical finding is confirmed — see Vulnerabilities.

​
Report templates

Templates let you standardize report formats. The Templates button on the Reports page opens template management for report and workflow templates. Templates are file-based, which means an entire organization can share the same standardized formats.
1

Create or upload a template

Add a template file through the Templates feature — create it directly or upload an existing file.
2

Rename and organize

Rename templates to keep the library understandable as it grows.
3

Reference templates in generation

Use the stored templates to keep report and workflow output consistent across teams and time periods.

​
Key concepts

Report templates are managed through the Templates feature — the Templates button on the Reports page. Templates are file-based and standardized across generated documents; see Report templates below.

​
Browse reports in the Console

The Reports page (under Security → Reports, route /reports) lists all generated reports.
1

Open Security → Reports

Navigate to the Reports page (/reports).
2

Filter the list

Use the filters to narrow the list: All, Summary, or Vulnerability.
3

Inspect a report

The table shows File name and Created for each report. Open a row to view or download the document.
The Templates button opens template management for report and workflow templates. Create, upload, rename, and organize templates to keep your organization’s formats standardized.

​
Preview a report

Previewing renders the report content from current workspace data without saving a report — the right way to validate filters and scope before generating.

​
Generate a report

Once the preview looks right, generate the report. Generation creates a stored report that appears in the list on the Reports page.
1

Preview the report

Inspect the preview so you generate exactly what you intend.
2

Generate the report

Generate the report with the same scope you previewed.
3

Verify the report is listed

The generated report appears in the Reports table with its file name and creation time.
You can scope a report to a date range and to a subset of targets — or include the whole workspace. A narrow scope keeps reports focused.

​
Download and view a report

Generated reports are stored in the workspace. From the Reports page, open a report by its File name to view or download it for distribution — attach it to notifications, share it with stakeholders, or archive it for audits.

​
Delete a report

Remove a report when it is outdated or was generated by mistake.
Deleting a report is permanent — the document is removed from the workspace and cannot be recovered. Export or archive anything you still need before deleting.
Everything available in the console is also available through the API — see the API Reference tab.

​
Best practices

  • Preview before generating. Always preview when the date range or target set changed, so you validate scope and content before committing a report.
  • Schedule generation. Combine report generation with workflows: attach a scheduled workflow to produce posture reports automatically — for example, a weekly summary — instead of generating manually.
  • Distribute through channels. Push generated reports through integrations so stakeholders receive them without manual download steps.
  • Scope reports to their audience. Keep executive summaries high-level and include only the evidence a compliance review actually needs.
  • Clean up the registry. Delete superseded drafts; keep the Reports table as a curated list of current, shareable documents.

Notifications

Get notified when scheduled report generation completes

Job Registry

Verify the scan and discovery tasks that feed report data completed

Integrations

Distribute generated reports through connected channels

Vulnerabilities

Understand the findings that populate vulnerability reports