Solution #1: Let's build a reporting tool

The team charged ahead and started building an automated reporting tool. At first, it was all going so smoothly!

I said, "This can't be that hard," and sure enough, there's a Python library. With a bit of Jinja and some terrible code, you can get halfway there. You can take a Qualys Scanner, a Nessus Scanner, whatever, and dump all the findings onto a report.

Remember, they didn't want to just dump scanner data into a Word document, they wanted to make sure that they could report in a meaningful way. That meant replacing default descriptions with their own descriptions, displaying Evidence for hosts in an easy-to-understand way, and more.

So, at this point, they had all the tool output in the Word document. Halfway there, right?

Then, you reach the other half which is actually like, 90% of the work where it's like:

"Okay, how do I nicely display evidence for all my hosts"

"How do I do a custom finding description lookup?"

You're going down this rabbit hole and at some point, I'm like, "Well, how long is this going to take?"

It's fun to do this, but what do I want to be spending my time doing?

What does [Company] want me spending my time doing? Do they want to fund my development of this tool or do they want me to be testing and making them money? It's a fairly obvious answer there.

The Results

The hidden costs of troubleshooting

Having a dedicated support team in your corner has had significant benefits that they didn't realize when they first started building an in-house reporting solution.

The hidden cost of troubleshooting your own solution is that when it breaks, it's me. It's me, and if I don't know the solution, then the project doesn't get delivered or I have to resort to manual reporting.

With the Dradis support team on their side, they can save hours and hours of troubleshooting time by just reaching out with a quick question.

If I'm in the middle of a report and I have a problem right now, I can be like,

"Hey Team. This is super strange."

"Yes, yes, crazy triangles."

and it saves me twelve hours of Googling around and staring at my computer.

If you run into an error message, the Dradis support team has probably seen it before! We take your feedback very seriously and are proud that our users are happy with their interactions with the support team.

Improved Security with the IssueLibrary

As mentioned before, this team was very concerned about the security implications of holding on to old customer reports.

The IssueLibrary allows us to take all of the useful, reusable stuff out of those old reports, but delete the client data when we're done.

There's no reason to maintain, to retain customer data anymore, which is a huge benefit in my opinion because a security testing company, if you lose all the security assessments, you're done.

Instead, they're loving the Dradis IssueLibrary which allows them to reuse the best vulnerability descriptions without risking exposing sensitive client data. And, the IssueLibrary allows them to perform automatic replacement (e.g. when this Nessus finding comes in, replace it with this IssueLibrary entry).

Looking to the future

Dradis allows this team to maintain their best work while expanding their team.

If I go through and I write the absolute best cross site scripting finding I've ever written, great. We put it in one place and we never have to worry about it again.

Gone are the days of hoarding reports and digging through to find "that one really good description". Instead, the best work is not just saved, it's automatically used in the future!

As the company looks to expand the security team in the future, they see Dradis as a valuable asset.

It's hugely worth it just for a one man army. With multiple, with an additional person, it just becomes ridiculously valuable.

When they add a new team member, they introduce them to Dradis and quickly integrate them into the team and allow that new team member to focus their time on what they do best.

Will this work for me?

Do you want the same results?

• Automate your reporting process.
• Get the Dradis support team in your corner.
• Spend less time reporting and more time hacking.
• Happier team!

Want to ask us a question about how Dradis Pro can help your project management and report creation?

Reach out to us on our Contact page or go ahead and request a demo.

Try Dradis for 30 Days

We are confident that Dradis Pro will improve your InfoSec workflow as it did for Include Security. If you try Dradis Pro for 30 days and don’t believe you’ve gotten your money’s worth, just let us know and we’ll give you your money back.