> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Executive Risk Reports: Board-Ready Cyber Reporting
> Understand the format, contents, and delivery schedule of Leverage Cyber's executive risk reports built for boards, CFOs, and investors.
Boards and investors do not make decisions based on vulnerability counts or patch percentages — they need financial exposure, business risk, and return on investment. Every Leverage Cyber executive report is built around that reality. From the 48-hour Initial Assessment through ongoing quarterly reassessments, your reports translate the technical findings from passive reconnaissance into the language leadership uses to allocate capital, evaluate risk posture, and satisfy audit and compliance requirements.
## Report Deliverables
Leverage Cyber produces two formal reports in the first week of engagement, followed by quarterly reassessment reports for the duration of your subscription.
**Initial Assessment Report — delivered within 48 hours of engagement start.** This report provides your first complete picture of the external attack surface. It includes a full attack surface inventory mapping all externally visible assets, every finding identified through passive reconnaissance with its associated ALE, and an executive summary distilling the most critical exposures into two to three pages suited for immediate board or leadership review. The 48-hour turnaround ensures you have actionable intelligence before the first week of your engagement is complete.
**Risk Report & Roadmap — delivered at the end of Week 1.** The Week 1 report builds on the Initial Assessment with a fully prioritized remediation roadmap ordered by ALE, an ROI analysis comparing your total portfolio ALE against estimated remediation costs, and a Risk Posture Rating that benchmarks your current posture against sector peers. This report serves as the primary deliverable for CISO and board presentations and forms the baseline against which future quarterly assessments measure progress.
## What's in an Executive Report
A two-to-three page narrative written for non-technical leadership. Covers total portfolio ALE, the three to five highest-priority findings, and the top-line ROI case for remediation.
A complete enumeration of all externally visible assets discovered during the assessment: domains, subdomains, exposed services, third-party dependencies, and leaked data references.
Every finding presented with Asset Exposure, Threat Likelihood, Exposure Window, and the calculated ALE. Findings are sorted by ALE descending so the highest-impact issues appear first.
A prioritized action list with effort estimates and dollar impact for each item. Structured for direct handoff to your engineering or security operations team.
A side-by-side comparison of total portfolio ALE against estimated remediation cost, producing a clear return-on-investment multiplier for leadership decision-making.
A letter-grade rating calibrated against sector peers, giving leadership a benchmark to evaluate your organization's relative security posture and communicate progress over time.
## The ROI Calculation
Every executive report includes an ROI calculation in the format below. The calculation answers the question boards and CFOs consistently ask: "What do we get for the money we spend on security?"
```
Total Annual Loss Expectancy (current risk): $2,400,000
Estimated Remediation Cost: $340,000
Risk Reduction (projected): ~85%
Return on Investment: 6.0×
```
The ROI multiplier is calculated by dividing the projected annual risk reduction (ALE × risk reduction percentage) by the estimated remediation cost. In the example above, remediating the identified findings is expected to eliminate $2,040,000 of annual risk exposure at a cost of $340,000 — a 6.0× return.
Estimated remediation costs are based on standard industry labor rates and vendor tooling costs for the specific remediation actions required. They represent a realistic budget estimate for your leadership team, not a vendor quote. Your actual costs may be lower if remediation can be absorbed into existing engineering capacity.
## Who Receives the Report
Leverage Cyber reports are formatted and structured for distribution to the following stakeholders, each of whom engages with different sections of the report.
**CISO and Security Leadership** use the full report — all findings, ALE details, and the remediation roadmap — to direct their team's work and track progress against the established baseline.
**CTO and Engineering Leadership** use the remediation roadmap to scope and prioritize engineering work, with effort estimates and priority tiers providing the input needed for sprint planning and quarterly roadmap decisions.
**CFO and Finance Leadership** use the executive summary and ROI analysis to evaluate security spend against risk reduction and to inform cyber insurance underwriting decisions and annual budget requests.
**Board Audit Committee** receives the executive summary, Risk Posture Rating, and portfolio ALE trend. The format is designed to satisfy board-level oversight responsibilities without requiring technical security expertise.
**Investors and M\&A Counterparties** may receive scoped versions of the report in due diligence contexts. The ALE-based format provides the financial risk language investors expect and supports informed valuation and deal structuring decisions.
## Report Confidentiality
All Leverage Cyber reports contain sensitive intelligence about your external attack surface and should be treated as confidential documents. Your reports are delivered through a secure, authenticated portal — never transmitted via standard email as an attachment.
Access to the report portal is limited to the stakeholders you designate during onboarding. Each stakeholder receives individual credentials; access logs are maintained for audit purposes. If you need to share findings with an external party such as a legal counsel, auditor, or M\&A advisor, your account team can provision a scoped, time-limited view that excludes findings details while retaining the executive summary and ROI data.
Quarterly reassessment reports follow the same format as the Initial Assessment and Week 1 reports, with one important addition: a period-over-period comparison table that shows which findings were remediated, which are new, and the net change in portfolio ALE. This comparison makes it straightforward to demonstrate an improving security posture to your board or audit committee over successive quarters.