Agree the buyer’s report requirements, tested boundaries, evidence, engineering handoff, and independence before commissioning an assessment.
Follow a fictional assessment from scope and coverage through three worked findings, proposed fixes, and retest outcomes.
Illustrative throughout. The system, findings, evidence and retest results are fictional. This is a demonstration of the report format, not a client result or an executed assessment.
Document the report reviewer and acceptance criteria alongside applications, APIs, roles, tenants, AI workflows, environments, test windows, permissions, exclusions, stop conditions, and escalation contacts. Confirm required tester qualifications before booking. Testing begins with written authorization.
Agree NDA requirements, access provisioning and removal, approved test data, evidence storage and sharing, permitted tools, retention, and deletion expectations. Any use of third-party AI tooling with engagement data requires agreement.
Identify identities, data flows, assets, dependencies, and trust boundaries. For AI, include model/provider routing, RAG, memory, agents, MCP, and tool execution.
Use tooling to support discovery and coverage, then manually validate relevant findings in the agreed environment. Keep a technical contact available for clarifications and escalation.
Record configurations, versions, accounts, preconditions, and exclusions. Separate observed findings from hypotheses, and note variability when AI behavior is not deterministic.
These examples show how a role, tenant, and workflow coverage matrix can be structured. They are planning examples, not completed tests or client results. The actual report adds versions, test status, evidence references, findings, and exclusions.
| Identity and workflow | Expected boundary | Evidence to record |
|---|---|---|
| SaaS member in test tenant A requests a tenant B export | The web and API paths enforce tenant and role authorization. | Test roles, synthetic record ownership, relevant requests, observed result, and coverage limits. |
| Support agent reads documents and invokes a refund tool | Retrieval respects the user’s access; a consequential action requires the agreed approval. | Agent identity, delegated scopes, tool-permission map, approval state, versions, and controlled trace. |
| A release adds a connector or changes a model | Review the new authority and data flow against the previous baseline. | Change identifier, affected tests, configuration, regression result, fix status, and review decision. |
Download the complete illustrative report, then discuss your buyer’s report requirements during scoping. The proposal records the agreed deliverables.
The proposal defines included engineering workshop time, remediation ownership, and one scoped retest for SaaS and AI assessments. Record each agreed fix as verified, unresolved, or not retested, with conditions and remaining limits. Substantial implementation is separately scoped.
Record changes to models, tools, data, permissions, and architecture against the tested baseline. Use the findings and expected workload to choose targeted follow-up or an annual plan. Continuous AI Assurance supports an agreed cadence with versioned regression and change records.
Founder-led describes delivery ownership: Jimmy leads security work and client scoping; Dev leads engineering and tooling. Independent describes the assessment’s separation from implementation. Confirm the delivery owner, report reviewer, and any implementation role during scoping. Meet the founders and review their work.
Our reports support engineering, procurement, and audit evidence. They do not certify a system, guarantee buyer acceptance, or replace a SOC 2 or ISO audit.
Remediation advice and fix verification are part of the agreed assessment. If DevBrows is separately engaged to implement a fix, document that role and arrange appropriate independent review before describing the resulting validation as independent assurance. Disclose who implemented, tested, and reviewed the change, along with any limits on independence.
Share your product, buyer requirement, and target date. We’ll confirm the engagement, deliverables, and commercial terms before work begins.