See exactly what you get.
Every Forge Line engagement ends in client-ready deliverables — not raw tool output. Here's the real thing, produced by the toolchain itself.
The deliverables
One engagement, run locally, produces all of these — branded, and yours to edit.
Client penetration-test report
CVSS-scored findings with description, impact, remediation, embedded evidence screenshots, MITRE ATT&CK tags, and actively-exploited (CISA KEV) flags pushed to the top of the priorities.
Compliance readiness — 21 frameworks
Findings + control answers mapped to CMMC, SOC 2, NIST 800-53 & CSF, ISO 27001, PCI DSS, HIPAA, FedRAMP, and more — down to control enhancements and assessment objectives, each row with a written rationale.
Plan of Action & Milestones
Every open item as a POA&M row — weakness and source filled from the assessment, with blank Owner / Scheduled-completion / Milestones columns for the client to complete. One of the two artifacts CMMC requires.
System Security Plan scaffold
System identification, roles, and a per-control implementation table pre-filled with the assessed status — the CMMC companion to the POA&M.
"Fix once, close many"
Ranks each root weakness by how many controls one fix closes across every assessed framework — the client's do-this-first page.
Engagement scope pack
Rules of Engagement, Authorization-to-Test letter, and Statement of Work generated from a short interview — the paperwork that makes the test authorized.
What the compliance views look like
Two examples straight from the toolchain — the actively-exploited callout the report leads with, and the cross-framework leverage ranking.
| # | Fix this | Weakness | Controls closed | Frameworks |
|---|---|---|---|---|
| 1 | Encryption of data in transit (TLS) | Assessment found: Deprecated TLS 1.0/1.1 | 13 | 6 |
| 2 | Application software security | Assessment found: SQL injection in portal login | 7 | 5 |
Verifiable by design
The numbers in these deliverables are meant to be checked, not taken on faith. Every scoring and mapping claim traces back to an authoritative source you can inspect.
Scored by FIRST's own algorithm
CVSS 4.0 base scores are computed locally by a port of FIRST's official calculator — no cloud call, no analyst guess. The port is checked against an independent reference implementation across every one of the 104,976 base vectors, plus a large random sample of threat/environmental vectors: zero disagreements.
Matched to the FIRST reference vectors
The 3.1 engine is validated against FIRST's published reference vectors, so a severity in your report is the same number the standard produces.
Control IDs from the official catalogs
No invented control numbers. NIST 800-53 line items are taken from NIST's official OSCAL catalog; a crosswalk-integrity test fails the build if any mapped ID doesn't exist. Observed gaps outrank self-reported "met," and untested areas read as Not Assessed — never a silent pass.
A provenance & limitations page
Each report and compliance deliverable ends with how it was produced — the scoring engines, the dated KEV snapshot, the standards mapped with versions, and the explicit limits of the assessment. Evidence screenshots carry a SHA-256 for chain of custody.
Samples use a fictional client ("Acme Corp"). The Forge Line is built by Genial Architect, AI-assisted and openly disclosed. These tools are for authorized security work only.