Reports & Compliance
Turn validated findings into deliverables for engineers, executives and auditors.
Turn validated findings into deliverables for engineers, executives and auditors.
Report types
| Report | Audience | Plan |
|---|---|---|
| Penetration Test | The default technical report with every validated finding. | All plans |
| OWASP | Findings organized against the OWASP Top 10. | Lite and above |
| Bug Bounty | Submission-ready write-ups for each finding. | Lite and above |
| Compliance | Control-by-control assessment against a chosen framework. | Lite and above |
| Executive | A short, non-technical summary of risk and priorities. | Hacker and above |
| SOC 2 | Evidence mapped to SOC 2 criteria. | Hacker and above |
| ISO 27001 | Evidence mapped to ISO 27001 controls. | Hacker and above |
| PCI DSS | Evidence mapped to PCI DSS requirements. | Hacker and above |
| AI Red Team | Results of AI red team runs with pass/fail by category. | Red Team and above |
Create a report
- Open Reports and choose New report.
- Select the scan or scans to include and the report type.
- Use the editor to review the content. Select, reorder and edit findings, add narrative and set the report details.
- Export it, or keep it in the Library to reuse later.
Export formats
| Format | Use it for | Plan |
|---|---|---|
| In-app view | Reading and sharing within your workspace. | All plans |
| Sharing with clients and stakeholders. | Hacker and above | |
| DOCX | Editing and adding your own material. | Hacker and above |
| JSON | Feeding findings into other systems. | Hacker and above |
Hacker and above can also schedule recurring reports.
Templates and branding
- Custom report templates — reusable layouts for your recurring deliverables (Red Team and above).
- Custom branding — your logo, brand color, company name and footer on every report (Red Team and above).
- White-label reports — remove Cyrion AI branding entirely (Enterprise).
Compliance frameworks
The Compliance page assesses your findings against 29 frameworks. Frameworks are included by plan.
Lite
GDPR and the OWASP Top 10.
Hacker
Everything in Lite, plus the security, privacy, industry and government catalogues:
| Category | Frameworks |
|---|---|
| Security | ISO 27001:2022, ISO 27002, NIST CSF and CSF 2.0, CIS Controls v8, COBIT 2019, CAIQ |
| Privacy | CCPA, ISO 27701:2025 |
| Industry | SOC 2, HIPAA, PCI DSS v4 |
| Government | NIS 2, DORA, NIST SP 800-53 Rev. 5, NIST SP 800-171, CMMC 2.0 |
Red Team
Everything above, plus the AI frameworks that read AI red team results:
ISO/IEC 42001:2023, OWASP LLM Top 10, NIST AI RMF, NIST AI 600-1, EU AI Act, MITRE ATLAS, Google SAIF, OWASP ML Top 10 and the AI Bill of Rights.
Info: Managing controls and mappings on the Compliance page is available from the Hacker plan.
Compliance flags on scans
If you operate under a regime such as PCI DSS or HIPAA, add it as a compliance flag when you launch a scan. Agents then follow strict do-not-extract and redaction rules, so sensitive data is not pulled into findings or evidence.