Introducing Self-Serve Reporting: Evidence You Generate Yourself
Generate your own reports in a few clicks, scoped to the assessments you choose, whenever you need them.
Your team has finished triage. The fixes are marked, the accepted risks are recorded, and your CISO wants the numbers before the next leadership review. You need a report that reflects all of it.
With self-serve reporting, you make it yourself. Pick the assessments, name the report and generate it in a few clicks from the Console, or through the XBOW API. You don’t need to file a ticket or wait on us.
Key takeaways
- Generate and regenerate your own reports in the Console or through the XBOW API, with no feature flag or opt-in.
- Choose what goes in: the latest assessment, all of them, or the ones you pick.
- Each report is a fixed snapshot. Regenerate any time and the earlier version stays as it was.
- The report XBOW generates automatically after each assessment covers that assessment only.
Your evidence, on your schedule
Every XBOW finding is a working exploit, and the report is how that proof reaches the people who judge your program: your auditors and your customers’ security reviewers. If that report is months old, so is their picture of your security.
Giles Douglas, CISO and Engineering Director at Superhuman, put it this way: “A continuous testing story is a far stronger attestation in our sales cycles than a point-in-time report from nine months ago.”
In a typical engagement, the testing firm writes the report and delivers it on its own timeline. XBOW runs continuously or on demand, with results in hours, and your reports keep the same pace. You decide when a report should reflect your latest triage, and you generate it yourself.
Reports whenever you need them
Choose the assessments that belong in the report: the most recent one, all of them, or a selection. The report shows what was true for that set on that date. Triage differently tomorrow and you generate a new one. The report you already shared stays as your reader saw it.
Each report comes in three formats from the same snapshot: a letter of attestation for auditors, an executive summary for leadership, and the full penetration testing report, with steps to reproduce, for your security and engineering teams.
XBOW lists every report you create in one table. Search it by name, filter it by assessment or status, and see whether a report is generating, ready or failed. Download the PDF from there, or do all of it through the XBOW API.
Built with the teams who use it
We built this with our customers as partners, many of them in regulated industries where auditors examine every report. One of them summed up the problem better than we could.
A global bank wrote one of their requests to us in a single sentence: the PDF report is an important audit artifact and must reflect the current state of findings, and they cannot come to XBOW every time a report needs regenerating. For that team, the hard part of the job had moved from the testing to the evidence.
One assessment, one report
The report XBOW generates automatically when an assessment finishes covers that assessment only, with each finding’s status as of that moment. That is how a pentester writes up an engagement: one report for the work they ran. Retest reports are the exception for now and still cover the whole asset. See what changed in automatically generated reports.
For a report with every finding on the asset, generate one with the scope “All completed assessments.” If your organization needs the automatic report to keep covering the whole asset, your account team can set that up.
Get started
If you run XBOW, open any asset in the Console, pick the assessments and generate your first report. The next time your CISO wants the numbers, you send a current report yourself. If your team works in pipelines, the XBOW API does the same thing.
If you’re evaluating XBOW, run it beside your current testing and compare what each proves. Then compare how long each takes to put a current report in your hands.
