An audit is only worth what you deliver from it. From a single stored audit, AdGUARD produces 6 different reports — one per audience — in 5 file formats and in both languages. Here is what each one is for, what it contains, and an extract of what it looks like.
6report types
5file formats
176controls reported
FR / ENfrom the same audit
Why several reports rather than one
The steering committee, the administrator who fixes things and the compliance officer are not looking for the same thing in the same audit. A single hundred-page document is read by nobody: the executive cannot find the decision, the administrator cannot find the offending object, the auditor cannot find the framework. AdGUARD therefore keeps one source of truth — the stored audit, with its date, its baseline and its scope — and renders it once per audience. The figures cannot drift between documents: they are computed once, not once per report.
The 6 report types
The type is picked at export time and applies to every requested format. Each report states the exact scope of the audit it comes from: without that, two reports for the same client are not comparable.
Executive report
Management · CISO · security committee
It answers, in one page, the only question a board asks: where do we stand, and is it getting better? The weighted score — a level 1 control counts three times a level 2 one — gives a single figure, comparable between audits and between entities; the change in points since the previous audit says whether the effort paid off. This is the document that releases a budget, not the one that explains how to fix things.
What it contains
The weighted compliance score and its change in points
The split between compliant, non-compliant, warnings and not evaluated
The heaviest non-conformities, written without technical jargon
The exact scope: baseline applied, date, controls actually evaluated
Detailed technical report
IT team · administrators · managed service provider
This is the report that makes the audit verifiable. Every control appears with its verdict and, above all, with the objects found: not “non-compliant”, but which accounts, which groups, which resources. The verification command is included, so the administrator can replay the check locally and, if need be, challenge the result. An audit you cannot replay does not get fixed: it gets argued about.
What it contains
Every evaluated control, grouped by category, with a stable identifier
The verdict and the named list of objects at fault
The PowerShell verification command and the link to the official documentation
The framework mapping, control by control
Prioritized remediation plan
Project manager · run team · client action plan
This is the report you take to the follow-up meeting. Non-conformities are sorted by real severity — level 1 controls first, then by the number of affected objects — rather than in catalog order: whatever would be exploited first comes at the top. In CSV or Excel, each row becomes a ticket; the action plan no longer has to be written, only assigned.
What it contains
Non-conformities sorted by priority, not by identifier
The action to take, written as an instruction
The number of affected objects, which gives the real workload
One row per action, ready to import into a ticketing tool
It translates the audit into the auditor's language. The same non-conformity does not weigh the same read through the ANSSI guide, a CIS benchmark or Annex A of ISO 27001; this report gives, framework by framework, how many controls are covered and the compliance rate reached. This is the exhibit you attach to a NIS2 file, an insurer's questionnaire or a client security review. It also gives the ANSSI maturity tier reached out of 5: a tier is only granted if no control in the lower tiers is failing — deliberately strict, which is what makes the figure credible.
What it contains
Coverage and compliance rate for every framework: ANSSI, MCSB, MITRE ATT&CK, CIS Windows Server, ISO 27001, NIST, NIS2, DORA
The controls behind each rate, so the figure can be justified
Controls not evaluated, counted separately — a partially covered framework says so
The ANSSI maturity tier reached, and what blocks the next one
Situation report
Steering committee · quarterly review
This is the recurring report, the one you re-read from one quarter to the next. It does not re-describe the audit: it says what moved since the previous one, at comparable scope — and says so explicitly when the scope changed, otherwise the curve lies. Regressions are listed before fixes: a control that becomes non-compliant again is a drift signal, not a detail.
What it contains
The score, the change in points and the trend curve over the period
Posture by category, from weakest to strongest
What regressed and what was fixed since the previous audit
The five priorities of the quarter, taken from the level 1 non-conformities
Scope notes: baseline, controls not evaluated, comparison point
Attack paths and trusts
Active Directory team · technical management · red team
This is the report that gets remediation approved. It does not say a right is misplaced: it shows the whole chain — which principal holds which right over which object, and in how many hops an ordinary user becomes a domain administrator. Each path is scored severity × breadth: a right held by “Domain Users” does not weigh the same as the same right held by one named account. The dsacls remediation plan is included with every modifying command commented out — the tool is read-only, nothing runs by accident.
What it contains
Paths sorted by score, with domain takeovers flagged separately
Grouping by target object and by holding principal
Group expansion: who really holds the right once memberships are resolved
A plain-language glossary of rights (GenericAll, WriteDACL, DCSync, ForceChangePassword…)
The trust map, with direction, filtering and the age of each trust secret
The commented dsacls plan, plus Graphviz and GraphML exports for yEd or Gephi
The 5 formats, and when to use them
The same report can be exported to several formats at once. They do not serve the same purpose: a PDF cannot be sorted, a CSV cannot be signed.
HTML
The web report: one standalone file, no external resource, opens in any browser. This is the one you send by email — the recipient installs nothing, the coloured tables and the diagrams are inside.
PDF
The paginated deliverable: the one that gets signed, archived and attached to a file. Table of contents, headers, page numbers, vector diagrams — this is the version of record.
Excel
The native .xlsx workbook, to sort, filter and annotate. This is where the remediation plan becomes a tracker: add an “owner” column, a “due date” column, and the report turns into the project board.
CSV
The universal import format: semicolon separator, UTF-8 with BOM, opens cleanly in Excel as well as in a ticketing tool or an online spreadsheet.
JSON
The complete structure — summary and controls. This is the integration format: SIEM ingestion, feeding a GRC tool, automated comparison of two audits, machine-readable archiving.
The attack path report additionally embeds two graph formats: Graphviz (.dot) and GraphML, which open in yEd or Gephi to rework the diagram before a presentation.
Where the reports come from
The report is not a separate step: it is the stored audit, rendered. The type and the formats are chosen at export time, and the file is written locally.
The export screen: pick the report type, then the formats (captured before the attack path report was added)Posture by category, as carried into the situation reportThe attack path graph, with its CSV export and its remediation script
Where each report lands in an engagement
A tool-based audit does not produce a document, it produces a sequence. Here is the usual order of an engagement, and the report that goes with it.
Day 0 — Framing
The baseline is frozen: which controls are in scope, which are excluded and why. Scope is written before the audit, not negotiated afterwards.
Day 1 — Audit
The audit runs read-only, then the detailed technical report goes to the IT team the same day — while the findings are still fresh and verifiable.
Day +2 — Management
The executive report, as a PDF: one score, one trend, three risks. This is the document that gets the decision made.
Week 1 — Plan
The remediation plan in Excel: one row per action, sorted by priority. Add an owner and a due date, and the project tracker exists.
Quarterly — Committee
Situation report: score, trend, posture by category, regressions and fixes since the previous committee.
Yearly — Compliance
The framework report, attached to the NIS2 or DORA file, to the insurer's questionnaire or to a large account's security review.