Every finding follows a consistent template: ID, title, severity, CVSS, affected systems, description, business impact, technical detail, steps to reproduce, evidence, remediation, and references - The MedSecure F-001 SQL injection example demonstrates the expected level of detail - Proof of concept