Sample client report bundle — illustrative output for a fictional MSP and client. All names are invented and every domain uses the reserved .example suffix.
See the MSP plan →Illustrative client review and evidence pack
Report date: 29 Sep 2026
Prepared for: Harbour & Vale Accountants
Prepared by: Brightline IT Services
Logo, colour, footer text, and the Prepared by / Prepared for fields are set once per client and reused on every bundle — your brand on the cover, not ours.
PHP advisory published 2026-10-21: CVE-2026-109618, CVE-2026-109619. The fictional observations below are earlier retained evidence.
Ask the host to confirm both security fixes in writing. These positions describe retained evidence, independently of the security score. A release label is not proof of the installed patch; no visible PHP is not a clearance. Upstream support ending does not exclude vendor backports.
harbourvale.example
Recorded PHP 8.1.34: normal upstream security support has ended
Ask the host to upgrade or confirm a vendor fix for both flaws. Source backports may be available; the version label does not verify the installed patch.
Fictional observation: PHP 8.1.34; the x-powered-by response header; 29 September 2026, 09:00 UTC; harbourvale.example. This is an earlier observation, not a new collection.
harbourvale-payroll.example
PHP details were not recorded in this fictional example
No PHP conclusion is available. Ask the host to confirm the runtime and both fixes; a score does not establish PHP patch status.
vale-pensions.example
PHP details were not recorded in this fictional example
No PHP conclusion is available. Ask the host to confirm the runtime and both fixes; a score does not establish PHP patch status.
harbourandvale.example
PHP details were not recorded in this fictional example
No PHP conclusion is available. Ask the host to confirm the runtime and both fixes; a score does not establish PHP patch status.
harbourvale-events.example
PHP details were not recorded in this fictional example
No PHP conclusion is available. Ask the host to confirm the runtime and both fixes; a score does not establish PHP patch status.
Start with the missing DMARC policy on two domains. One affected domain has no main score, but its observed DNS finding still needs attention. Confirm legitimate senders before deciding how to enforce the policy.
Four of five completed scans have a published score, including one lower bound. This is a first baseline: no comparable earlier evidence establishes improvement or repair. Reports reuse retained evidence and do not initiate new checks.
5
Completed scans
4 of 5
Published scores
At least 75
Published-score average
1
Without a main score
Three point scores and one lower bound contribute to the average. The completed unscored domain is excluded from that average, but its observed findings remain in the action plan. Published-score coverage does not mean every check was observed.
This fictional baseline has no comparable earlier scans for the 7, 30 or 90-day windows. No improvement, deterioration or verified resolution can be established yet.
High priority · 2 domains. No DMARC policy was observed on two domains, including one without a main score.
Next action: Confirm legitimate sending services, publish a DMARC policy and review aggregate reports before tightening enforcement. Repeat the relevant checks to verify the change.
First observed and last confirmed: 29 Sep 2026. Verification pending; absence alone will not establish repair.
| Domain | Score | Last scan | Evidence |
|---|---|---|---|
| harbourvale.example | At least 58 | 29 Sep 2026 | Headers incomplete; lower bound published |
| harbourvale-payroll.example | 72 | 29 Sep 2026 | Point score published |
| vale-pensions.example | 81 | 29 Sep 2026 | Point score published |
| harbourandvale.example | 88 | 29 Sep 2026 | Point score published |
| harbourvale-events.example | Not scored | 29 Sep 2026 | Website certificate evidence unavailable. |
Scope note: Pro and MSP include Portfolio client workspaces; MSP adds branded client reporting. Results reflect conditions at the latest completed scan time and should be used as a prioritisation aid, not as a replacement for a full security audit.
Evidence-pack PDF
The evidence pack supports reviews, while the evidence and coverage appendix retains detailed observations and gaps. Board analysis summarises the main issues and next decisions. Unavailable comparisons remain explicit across reports.
Report check before download
A preview of coverage, at-risk domains, and branding before anything is generated — no surprises with your name on them.
Read-only client portal
Invite client contacts to a view limited to their own dashboard and reports — a window for the client, the cockpit for you.
The MSP plan is £99/month: 250 tracked domains and 250 daily checks shared across security scans, authenticity investigations, and signed-in email checks. Pro already includes client grouping. MSP adds daily security monitoring with a deeper refresh when material change is detected, weekly or monthly full scans, Priorities, Alerts, client audit trails, Board Analysis, and branded PDF bundles like this one.