Security Briefing Deck

About this template

When to use this

Sixteen slides for reporting a completed security review: a quarterly scan, an external penetration test, or a pre-audit check. It answers what was checked, what was found, and what gets fixed by when. Live incident updates need a timeline format instead, so keep those in a separate document.

The eight agenda lines are already the reporting order

The order is cover, agenda, five divider-and-body pairs, a comparison slide, metric cards, trend bars, and a closing slide. The agenda holds eight items – scope and method, findings by severity, penetration test results, owners and deadlines, re-testing and prevention, findings versus remediation, key metrics, trend analysis – and every one of the eight has a slide behind it. The first five use the SECTION 01-05 dividers with their body slides (3-4, 5-6, 7-8, 9-10, 11-12); item 06 is the left-right comparison on slide 13, item 07 the cards on slide 14, item 08 the bars on slide 15. Nothing is a name without a slide, so the work is replacing the wording with your own review vocabulary – and the divider, the body title and the agenda line all have to change together.

1. Put scope and dates on the cover, for example: first-half 2026 regular security review – 18 external services, May 6 to May 24.
2. Rewrite the agenda wording in your own terms, for example: 01 scope and method, 02 findings, 03 attack scenarios, 04 remediation plan, 05 re-test schedule, 06 before and after.
3. Match the five body titles to the dividers and the agenda. Each body slide repeats its divider heading, so changing one side alone leaves the deck inconsistent.
4. Each body slide is a lead line plus three items. Show severity, affected system and fix date on every line; the shipped lines – full review of 18 external services, 2 critical / 9 high / 27 medium, critical items patched within 72 hours – show the form.

Writing up a finding

• For example, High – SQL injection through an order lookup parameter; production fix March 20, input validation applied as an interim control.
• For example, Medium – no session expiry on the admin console; changed to 30-minute idle timeout, March 27.
• For example, Low – seven accounts of departed staff still active; disabled immediately, automatic revocation via the HR integration in April.

The comparison slide is before and after

Slide 13 puts what the review found on the left (admin accounts without two-factor, seven externally exposed ports, 38 unpatched vulnerabilities) opposite what was done on the right (two-factor on every admin account, exposed ports cut to two, 11 critical and high items patched first). It is not this review against the last one but findings paired with their remediation inside this review, so keep one right-hand line answering each left-hand line. The 38 unpatched items on the left is the same number as the findings card on slide 14; change one and the room will notice.

Metrics and chart

The four cards ship as 38 findings, 2 critical, 72 hours to emergency fix and 18 asset types reviewed – already the right kind. Each of them repeats a number from an earlier slide (38 from slide 13, 2 critical from the severity slide, 72 hours from the deadline slide, 18 from the scope slide), so update them together. To add a remediation rate, replace the asset-type card; the rate is fixed items over total findings (38), so it must agree with earlier counts. The four bars rise as remediation progresses (15 at review, 47 at two weeks, 81 at four, 97 at eight); plotting open high-severity findings instead (12, 9, 5, 3) means reversing the bar heights as well.

Watch out for

• Pasting exploit detail into a widely circulated deck; keep it in an access-controlled document.
• Leaving the six lines on slide 13 as shipped instead of the findings your own review produced and what you did about each.
• Keeping only the blocked outcome, such as the line saying customer data access was blocked, and deleting what did get through. The line about reaching the admin screen from outside is the point of the report; without it there is no basis for demanding a deadline.
• Reporting only closed items and hiding open ones.