Prioritized list of findings - Each finding includes: description, evidence, business impact, ATT&CK mapping, remediation - Short-term, medium-term, and long-term recommendations - Investment priorities based on maximum risk reduction