Customer response pack

A customer asked for a security report—what should you send?

Published by Surveil-X · October 31, 2026 · Practical guide

Short answer First clarify what the customer means by ‘security report.’ Send the narrowest current artifact that answers the request, accompanied by scope, date, methodology, limitations, remediation status, and a security contact. Do not send sensitive raw findings or imply an automated report is a formal audit.

Who this guide is for

Founders, sales engineers, CTOs, and operations teams responding to customer diligence.

Key takeaways

Clarify the requested artifact before sending files.
Use current, approved, customer-safe versions.
Include scope and limitations in the message.
Separate open remediation details from executive findings.
Offer a controlled follow-up for sensitive questions.

Ask what the buyer needs

‘Security report’ may mean a penetration-test executive summary, SOC 2 report, vulnerability assessment, external posture report, security overview, or questionnaire evidence. Ask what decision they are supporting, what period is acceptable, and whether they have a required standard.

Assemble the minimum useful package

A useful response may include a security overview, current external or independent assessment summary, scope and limitations, remediation status for material findings, and a named contact. Provide supporting policies or evidence only when relevant and approved.

Protect sensitive information

Use access controls or an NDA where appropriate. Redact exploit details, credentials, personal data, customer-specific architecture, and information that creates unnecessary attack value. Keep a record of what was shared and with whom.

Explain what happens next

If the artifact does not fully answer the request, say so. Offer a follow-up call, controlled document review, target date for updated evidence, or a plan for deeper assurance instead of stretching the meaning of the available report.

Recommended workflow

Clarify the artifact requested.
Select a current approved report.
Add scope and limitations.
Review confidentiality and sharing controls.
Track follow-up questions and commitments.

Use the worksheet

Turn the guide into an owned process.

Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.

Open printable checklist

Frequently asked questions

Should we send a full vulnerability report?

Only after confirming the recipient, need, authorization, and safe sharing method. An executive or redacted version is often more appropriate.

What if we only have an automated scan?

Describe it accurately as an automated external assessment and explain what it does not validate.

Can we refuse to share a report?

You can offer controlled alternatives, but commercial and contractual consequences should be evaluated by authorized business owners.

Sources and further reading

This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.