# Technical Report

## Document Control

| Field | Value |
|---|---|
| Reference | [REF] |
| Client | [CLIENT] |
| Report Date | [YYYY-MM-DD] |
| Classification | Confidential |
| Methodology | [PTES/NIST/OWASP/etc.] |
| Operators | [NAMES] |

## Scope

| Asset | Type | Environment | Status |
|---|---|---|---|
| [asset] | [web/api/cloud/etc.] | [prod/stage/lab] | In scope |

## Exclusions and Constraints

[Document excluded systems, unsafe techniques, testing windows, data handling limits, and assumptions.]

## Methodology

Testing followed the approved SEAD and Rules of Engagement. Activities were grouped into planning, reconnaissance, exploitation validation, post-exploitation impact analysis, and reporting.

## Tooling Summary

| Category | Tools | Purpose |
|---|---|---|
| Reconnaissance | [tools] | Asset discovery and exposure review |
| Web/API | [tools] | Manual and assisted validation |
| Cloud/Infra | [tools] | Configuration and identity review |
| Reporting | RTExit scripts | Evidence, findings, and report generation |

## Findings Summary

| ID | Title | Severity | CVSS | Asset | Status |
|---|---|---|---:|---|---|
| F-001 | [Title] | [Severity] | [Score] | [Asset] | [Status] |

## Detailed Findings

Each finding should include description, affected assets, evidence, reproduction steps, impact, CVSS vector, MITRE mapping, and remediation.

## Attack Chains

| Chain | Findings | Objective | Business Impact |
|---|---|---|---|
| CHAIN-001 | [F-001, F-002] | [objective] | [impact] |

## Remediation Plan

Prioritize fixes by exploitability, business impact, exposed data, and dependency relationships.

## Appendices

- Evidence index
- Chain of custody
- MITRE ATT&CK mapping
- CVSS vectors
- Raw tool output references
