We always say that the most important part of delivering security services is reporting. I agree. If you can't get your message across, the value of your service drops immensely. A thread.

(1) In essence, you're telling a story. Your report has a beginning, a middle, and an end. Let's call it the exec summary, the findings, and the conclusions. Pro-tip 1 : don't lose that structure. Stick to it like glue. Anything that doesn't fit in "the story" -> appendix.

(2) Exec Summary : target audience = non technical. They likely won't read the rest of the report. Be succinct, be direct, be authorative. (Give kudos where kudos are due). Use graphs, but ask yourself if your audience can "get them" at a glance.

(2 cntd.) If they can't ... change the graphs. Ground rule : no pie charts. Like for real, keep the pie for dessert.

(3) The Findings. Audience is likely technical. These people will have to work with what you put here. They don't deserve bullshit. Respect them. Provide as much detail as possible. Be accurate, be detailed. A baller exec summary with a mediocre set of findings is meh.

(4) Conclusions :) aka, the end. Everything you say here needs to be supported by your findings. Don't make assumptions. If you don't know, ask. Or drop it. Use references. Make your stuff easy to navigate.

(5) Note that all three parts tie together. Yes, you can have varying levels of detail across the 3 main components but your story must be consistent. If it isn't, you will be challenged. Got a box of $100 words? Shove it under the desk. You're aiming at grade 8 reading level.

(6) This is not a drawing book. Be conscious about using color. Be consistent in colors across charts. NO default color schemes. Remember that the colors you use have to mean something. If they don't, use gray scale.

(7) By the way : Some of your readers might be color-blind. They'll hate you forever if you ignore them. Kidding, they're used to being ignored but that doesn't mean you should not try to be better.

(8) Fonts : Again, consistency. One standard font. Use bold, italic, etc. for emphasis. Use a mono-spaced font for code. etc. etc. You don't pick fonts because they're attractive, pick them to support the story you want to tell. Your game is visual.

(9) Language : avoid repetition! (... the service. The service ...) Don't! It's a capital sin. Again, short sentences. Learn synonyms ... A LOT of them! I've made it a game to keep my texts interesting that way. It's actually fun.

(10) ground truth : "The hardest part about writing is deleting". When you feel you're finished, go back and cull anything that is superfluous. If you can delete, you can write. Make it tight. FIN.

(11) Avoid suggestive language! "we would recommend". Wtf? You're being paid a lot of money for this work. We don't wanna know what you "would" do, we want to know what you "will" do.

(12) Best exercise : go back to reports from 2-3 years ago and rewrite them based on your current experience. Past you is your best teacher.