Executive Summary

The executive summary system generates a one-page, print-optimized HTML summary of scan results for CISOs, CTOs, and other decision-makers: a single A4/Letter page with key metrics, the risk score and grade, top findings, remediation progress, and an optional white-label call to action. It is built from a generator script and a Mustache-like template engine.

Components

Generator: executive_summary.sh

scripts/executive_summary.sh orchestrates generation. Its core function reads the session JSON, builds a template context, renders the HTML, sets 600 file permissions, and optionally exports a PDF.

generate_exec_summary "session.json" "exec_summary.html" ["config.conf"]

It can run standalone against any existing session:

./scripts/executive_summary.sh session_results.json exec_summary.html \
    ~/netvuln-tool/configs/acme_corp.conf

jq is required. If jq is unavailable, the generator warns and skips.

Template Engine: lib/exec_template.sh

The template engine library provides Mustache-like rendering. All functions use the et_* prefix.

et_build_context()

Extracts all template variables from the session JSON (and the config file) into one flat JSON object. This includes:

• Client metadata (name, scope, assessor, report date, title, subtitle)
• Risk score and letter grade, plus the operational risk score and grade (dual model)
• Exception count and the score delta they contribute
• Finding counts by severity and their percentages
• Totals: hosts, domains, ports, findings
• Top findings list and the three headline recommendations
• Remediation progress (total, resolved, in-progress, new, persistent, deferred, percent done)
• Compliance summary and framework list, plus ORC 9.64 readiness fields
• Branding values (primary color, company name, footer text/email/URL) and tool version

et_render()

Renders an HTML template using the context JSON. Supported syntax:

Syntax	Description
{{variable}}	HTML-escaped variable substitution
{{{variable}}}	Raw (unescaped) variable substitution
{{#if condition}}...{{/if}}	Conditional block
{{#unless condition}}...{{/unless}}	Inverted conditional block
{{#each collection}}...{{/each}}	Iteration over arrays

_et_export_pdf()

Optional PDF export via wkhtmltopdf. Enabled by setting EXEC_SUMMARY_PDF="true" in the config file. The export uses A4 page size with 10mm top and bottom margins. If wkhtmltopdf is not installed, a warning is printed with the platform-appropriate install hint and the HTML is still produced.

Templates

Default Template

The default template is templates/exec_summary_default.html. It provides a clean one-page layout with a branding header, risk score and letter-grade visualization, a finding summary by severity, a top critical/high findings list, a remediation progress overview, and, where present, compliance and ORC 9.64 readiness blocks.

Custom Templates

Provide a custom HTML template via the EXEC_SUMMARY_TEMPLATE config variable:

# In the config file:
EXEC_SUMMARY_TEMPLATE="/path/to/custom_template.html"

Custom templates use the same Mustache-like syntax and have access to every variable produced by et_build_context().

Generating During a Scan

Pass --exec-summary to the recon pipeline to generate the summary as a post-report step, or --email to generate and send it. --email implies --exec-summary.

# Generate the summary alongside the report
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf --exec-summary

# Generate and email it to stakeholders
./scripts/vulnscan_recon.sh -t 192.168.1.0/24 --full -R report.html \
    -c ~/netvuln-tool/configs/acme_corp.conf --email ciso@client.example.com

The Python orchestrator supports the same flags:

python3 -m netvuln recon -t 10.0.0.0/24 --full --exec-summary --email ciso@client.example.com

You can also enable generation directly in the config with EXEC_SUMMARY_ENABLED="true".

Configuration

Variable	Default	Description
EXEC_SUMMARY_ENABLED	false	Generate an executive summary during the pipeline
EXEC_SUMMARY_TEMPLATE	built-in	Path to a custom HTML template
EXEC_SUMMARY_PDF	false	Generate a PDF alongside the HTML (requires wkhtmltopdf)
EXEC_SUMMARY_RECIPIENTS		Comma-separated email recipients
EMAIL_FROM	netvuln@bullium.com	Sender address for the emailed summary
EMAIL_SUBJECT	auto-generated	Custom email subject

Email delivery uses the local mail/sendmail/msmtp toolchain. See Report Configuration for the full variable list and Alert Notifications for the shared email backend.

Portal Integration

Executive summaries are uploaded to the consultation portal as part of the session submission, and the portal can view them alongside the full report in the collect dashboard.

The upload chain: submit_session.sh sends the exec summary HTML as the sixth multipart parameter, upload.mjs receives and stores it, and download.mjs includes it in the retrieval whitelist. When pushing manually, push_session.sh -e <file> attaches the summary. See Session Management and API Contract.

The scoring model behind the risk score and grade is documented in Scoring Methodology.