Reports and security audits

Generate bounded executive, technical, posture, and post-incident reports with explicit coverage.

Reports record a selected scope and collection cutoff for customer, leadership, or auditor review. They identify what was assessed and observed. They do not certify compliance.

Generate a reportCopy link

You need access to every selected asset or incident. Unmasked content and raw evidence require their separate grants; the report request cannot expand those permissions.

1. Open Reports → Create report and choose executive summary, incident review, vulnerability posture, engagement deliverable, or audit evidence.
2. Select permitted assets or incidents, audience, and redaction level. Set explicit start and end times in UTC and inspect the time-zone rendering.
3. Choose PDF or JSON. For vulnerability finding tables, you can also choose CSV.
4. Submit the request and open its operation. Wait for succeeded, then inspect Reports → Report → Downloads for the artifact, cutoff, and coverage gaps.

If the request fails authorization, narrow it to permitted targets or obtain the missing grant. For generation failures, inspect the operation's error before creating a replacement request. The organization must own the selected scope; Guard rejects an unauthorized request instead of returning a silently incomplete report.

Interpret contentCopy link

A completed report lists its generation time, collection cutoff, sources, policy revisions where relevant, unknown coverage, skipped targets, scan authentication basis, accepted risks, and active exceptions. Executive summaries use masked context and business impact; technical attachments require the corresponding sensitive-data or evidence grants.

Post-incident reports separate detection, notification, approval, acknowledged containment, and application restoration times. Include actions left active, incomplete remediation, and the owner of each follow-up. An incident closure timestamp cannot substitute for the actual end of isolation or outage.

Share and regenerateCopy link

Open Reports → Report → Downloads for the approved artifact. Download links expire and are access checked. Share the exported artifact using your organization's approved channel; Guard cannot revoke a file after a recipient has downloaded it. Avoid including unmasked employee information in a general customer report.

Reports are immutable after completion. New telemetry or changed conclusions require Report → Regenerate, which creates a new report ID with a later cutoff. Keep the earlier record when it was used for a decision. Report deletion is subject to holds and retention.

For a dedicated security audit, request the agreed review under Assessments → Audits and link its control scope and evidence. A generated report alone does not establish a certification. See Report API.