Findings only matter once someone outside the security team can read them. Vooki Pro produces two kinds of report, for two audiences, from the same scan.

Two kinds of report

• Standard report: the technical write-up for developers. It covers findings by severity, with request and response evidence, CVSS scores, CWE references and remediation guidance.
• Compliance report: the same findings mapped control by control to a framework, for auditors.

Formats

Compliance reports come in HTML and PDF. From the CLI you can also produce SARIF for security tooling (this needs CI/CD Export on your licence).

Generate a report

1. Open the scan from Scans.
2. Before exporting, mark any false positives. They are left out of the active findings in the report.
3. Open the Export menu.
4. Choose Standard, or Compliance and a framework.
5. Pick the format and choose where to save the file.

From the CLI, set report_format, report_type and compliance_framework in the config. See CLI and CI/CD.

Compliance frameworks

• OWASP Top 10
• PCI DSS v4
• NIST SP 800-53
• ISO/IEC 27001 (Annex A)
• HIPAA
• GDPR
• SOC 2

A compliance report is evidence of testing, not a certificate of compliance. It shows what was scanned, what was found and how each finding maps to the framework's controls. Your assessor decides what that means for your programme.

What is in a report

• Target, scan date, policy and scope, so the reader knows what was and was not tested
• An executive summary with severity counts
• Every finding with description, impact, affected URL and parameter, CVSS score, CWE and remediation
• The request and response evidence behind each finding
• Framework control mappings (compliance reports)

Sharing the whole scan instead

To give a colleague the scan itself rather than a document, export a .vpscan archive. They can import it with Scans → Import and triage or retest it as if they had run it.

Full reference: Reports & compliance (docs)