Sample report. Every name and number is invented.
Report
What each person caught and missed on the assessments you set, by CWE and by language, with the settings each assessment ran under. Personal training never appears here.
- Organisation
- Fernbrook Systems
- Period
- All timeeverything recorded, up to 31 Aug 2026
- Produced
- 31 Aug 2026, 09:14 UTCPeriod boundaries are cut in UTC.
- Named detail
- Open. This document names people.
What this period shows
- 39 of the 54 people who finished are below the pass mark of 80, and 15 are at or above it.
- The weakest published category is cryptography, where 61% of its weaknesses were found.
- 9 of the 63 assignments in this period were not finished.
- 61 people held a licence against 50 bought, so at least one licence was passed between people, and the results cover more people than there are licences.
Every line above comes from the figures on this page. Nothing is said about a figure this report has withheld.
More people held a licence than were bought, so at least one licence was passed between people and the results cover more people than there are licences.
Coverage by CWE category
What the assessed work actually exercised, and how much of it was caught. Categories with too few people behind them are not published as an average.
- Access control64% caught108 found of 16860 missed34 people
- Injection67% caught84 found of 12642 missed22 people
- Authentication70% caught39 found of 5617 missed14 people
- Cryptography61% caught33 found of 5421 missed18 people
- Sessions and cookies74% caught31 found of 4211 missed14 people
- Business logic70% caught28 found of 4012 missed10 people
- Data exposure70% caught28 found of 4012 missed20 people
- Request forgery65% caught26 found of 4014 missed10 people
- AI safety71% caught17 found of 247 missed12 people
1 further value is not listed, because fewer than ten people are behind it and an average over fewer than ten identifies people.
Coverage by language
The same breakdown by the language of the codebase reviewed, taken from what each codebase declares.
- TypeScript65% caught143 found of 22077 missed34 people
- Java71% caught89 found of 12637 missed14 people
- Python63% caught57 found of 9033 missed22 people
- PHP70% caught59 found of 8425 missed12 people
- Ruby66% caught46 found of 7024 missed18 people
1 further value is not listed, because fewer than ten people are behind it and an average over fewer than ten identifies people.
People
Open: named per-person detail is included for the roles entitled to it.
Status is the product's own grade, on the same pass mark it uses for every submission: a median score of 80 or more is a pass. Below the mark reads Needs work, and Well below where the score is also under the median of the people listed here, which is 60.5. That median is for this table, not the published team figure above. Somebody who has not finished their assessment is not graded yet: they read In progress, or Not finished once its window has closed, with their figures so far.
Showing 1 to 15 of 54
All 54 people with assessed work in this period.
Page 1 of 4
Retakes
Every attempt is recorded. A retake replaces the earlier attempt in the figures only once it is submitted, and the earlier sitting stays on the record. The results replaced in this period are under Retaken sittings. One retake touched this period, granted or sat inside it.
| Person | Assessment | Granted | Re-sit |
|---|---|---|---|
| Grace Ntuli | The third quarter access control review | 11 Aug 2026 | Submitted 11 Aug 2026 |
Retaken sittings
Each result below was replaced by a retake in this period and is not in the figures above.
| Person | Assessment | Challenge | Score | Submitted | Replaced |
|---|---|---|---|---|---|
| Grace Ntuli | The third quarter access control review | A session cookie without its flags | 33 | 10 Aug 2026 | 11 Aug 2026 |
Assessments
Every assessment set or sat in this period. Each row shows when it ran, which switches were on, and how far people got. All four completion figures count the assignments in this period.
| Assessment | Window | Switched on | Completion |
|---|---|---|---|
The third quarter access control review 6 challengesset 28 Jul 2026 | Closed 17 Aug 2026 | Number of findings | 14 submitted2 not completed in window |
The third quarter injection review for the payments squad 5 challengesset 6 Jul 2026 | Closed 31 Jul 2026 | Number of findings | 12 submitted2 not completed in window |
The second quarter secrets review for the platform squad 4 challengesset 8 Jun 2026 | Closed 30 Jun 2026 | Number of findings | 8 submitted |
The second quarter business logic review for the client applications squad 5 challengesset 14 May 2026 | Closed 5 Jun 2026 | Number of findings | 10 submitted2 not completed in window |
The first round access control and cryptography review, 2025 4 challengesset 20 May 2025 | Closed 20 Jun 2025 | HintsNumber of findings | 10 submitted3 not completed in window |
Who has not finished
The people behind the counts above. The counts are published at every visibility level. The names follow the same level as the people table, so a level that switches names off shows the counts and not the people.
The third quarter access control review2 people have not finished
- Priti Raval [email protected]Not completed in windowassigned 3 Aug 2026opened 6 Aug 2026
- Niamh Corrigan [email protected]Not completed in windowassigned 3 Aug 2026never opened
The third quarter injection review for the payments squad2 people have not finished
- Kwabena Mensah [email protected]Not completed in windowassigned 13 Jul 2026opened 20 Jul 2026
- Larissa Petrova [email protected]Not completed in windowassigned 13 Jul 2026opened 29 Jul 2026
The second quarter business logic review for the client applications squad2 people have not finished
- Domhnall Kearney [email protected]Not completed in windowassigned 18 May 2026never opened
- Hakim Ferhat [email protected]Not completed in windowassigned 18 May 2026opened 3 Jun 2026
The first round access control and cryptography review, 20253 people have not finished
- Domhnall Kearney [email protected]Not completed in windowassigned 1 Jun 2025never opened
- Priti Raval [email protected]Not completed in windowassigned 1 Jun 2025never opened
- Jun-ho Baek [email protected]Not completed in windowassigned 1 Jun 2025opened 18 Jun 2025
The comparison on this tab does not exist for a paying team today, and the figures below were invented for this sample. It is published once a model has been run on these challenges, and no run has been published yet. A real report says so here and shows nothing.
Against a frontier model
How a frontier model scored on the same challenges, given the same changes and marked against the same correct answers, with no hints and no walkthrough. The model is not named: these figures are invented for this sample.
Both figures are scores out of 100 over the same challenges. A person is only compared on work a published run covers.
6 of these 54 people scored level with the model, within 2 points either way. 21 scored above it and 27 below. The table opens with the closest first.
54 people are compared here. 21 scored above the model, 27 below it, and 6 within 2 points of it either way.
Rows within 2 points of the model, either way, are marked.
The same report, anonymised
This is the same period's report with the names switched off. Only the person themselves sees their own detail. The totals, the delivery record and the licence figures do not change.
More people held a licence than were bought, so at least one licence was passed between people and the results cover more people than there are licences.
Per-person detail
This preview leaves every person out. Your organisation is at Open, so the full report names them. At the Anonymised level itself, the team figures and the two coverage tables are withheld too.
The delivery record above still shows 54 submitted assignments.
The team against a frontier model
The comparison from the benchmarks tab, as counts instead of names. Each band is a number of people.
- More than 10 points below13
- 2 to 10 points below14
- Within 2 points either way6
- 2 to 10 points above4
- More than 10 points above17
54 people are compared here, and 6 of them scored within 2 points of the model either way.
What the record still shows
- Assessments set or sat
- 5
- Assignments made
- 63
- Assignments completed
- 54
- Distinct people who held a licence in this period
- 61
The two coverage tables at the front of the report withhold 2 values between them, because fewer than ten people are behind them.
Licence integrity
An auditor reads these figures together. If more people held a licence than were bought, a licence was passed between people, and the results above cover more people than there are licences.
- Licences bought, as things stand today
- 50
- Assigned right now
- 48
- Distinct people who held a licence in this period
- 61
More people held a licence than were bought, so at least one licence was passed between people and the results cover more people than there are licences.
The first two figures are the position today. The last covers the period, so where licences were bought or given up part way through, the comparison is across two dates. A licence can move to someone else once a calendar month. The count of people who held a licence comes from the licence assignments and releases in your audit log, and it appears on the export.
Export
The PDF is the document you hand over. It is the whole report: the period it covers, how the exercises were built and marked, what each person caught and missed, the settings each assessment ran under, the licence figures, and the clauses in PCI DSS, DORA, ISO 27001 and the EU AI Act that this record answers.
The CSV is the same figures as rows. It opens in a spreadsheet, so someone checking the report can add the numbers up themselves, and it is the copy to keep if you want to compare this period with the next one.
Both cover the period selected above. Each of the other tabs also exports its own table on its own.
Both are produced here for real, by the same code that produces a customer's, over the invented rows on this page. Every page of the PDF is watermarked, the file names say sample, and the document says inside itself that it is not evidence. The four per-section spreadsheets on the other tabs are not produced here, because each one is recorded against an organisation and there is none behind this page.
What this record does not establish
What this record establishes: that the account named against each result was signed in, submitted those findings in the window shown, and was marked on our server against a prepared answer the browser never receives. The exercise is never published, so it cannot be practised beforehand. Hints are off unless an administrator switched them on, which is stated on each row. No assessment shows a walkthrough or a video, whatever its switches say.
What it does not establish: who was at the keyboard. The sitting is not invigilated. Nothing here shows whether the named person worked alone, whether someone was helping, or whether the changes were pasted into another tool. We only see what the product offered and what was submitted to it.
Read a result as evidence of work done under this account, in this window, under the stated settings. Where a role needs more than that, run the sitting under your own supervision and record that alongside this document.
Who is in this document: everybody who was assigned an assessment in the period and held a licence when they sat it. That is not necessarily everybody who writes code here. This record cannot say how many engineers the organisation has or how the people assigned were chosen. An auditor who needs that should ask for it.
These paragraphs are in the exported document as well, so a reader who is handed the file reads the same thing.
Every export is recorded against this team, with the period it covers and who produced it. That record is in the audit log.