Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you're writing a report, what person do you write it as?

First person singular: I discovered a vulnerability in HP Power Manager...

First person plural: We discovered a vulnerability in HP Power Manager...

Third person singular, by name: Bob discovered a vulnerability in HP Power Manager...

Third person singular, general: The tester discovered a vulnerability in HP Power Manager...

Third person singular, attacker: The attacker discovered a vulnerability in HP Power Manager...

share|improve this question
95  
What, no love for 16th century second person singular? "Thou hast run Nessus against the bastion host..." – Parthian Shot Jan 27 at 5:26
6  
this belongs on english.SE? – limbenjamin Jan 27 at 7:03
11  
Definitely not, @limbenjamin. Writers SE, possibly. They have a tag for technical writing. – TRiG Jan 27 at 10:52
up vote 48 down vote accepted

Some other options:

Passive voice: A vulnerability in HP Power Manager was discovered...

Present tense: HP Power Manager is vulnerable to...

It is most common (in the UK at least) to use the passive voice. I prefer using present tense when possible, and first person plural otherwise; the writing feels more personal. But this is controversial; a lot of people think reports are supposed to be formal and not at all personal.

share|improve this answer
9  
+HP Power Manager has been found vulnerable to... – Eugene Ryabtsev Jan 27 at 5:47
1  
I think it's really depends on the company. I remember when I was at school I was taught to use the passive voice for reports, then one day I took a class where I lost marks for using it and was told to use the active voice. – Celeritas Jan 27 at 5:47
12  
Reports I've seen tend to be in passive past tense - avoids judgement, and suggests that the subject of the report might have fixed it since the test was carried out, because they are on the ball and efficient. – Matthew Jan 27 at 7:02
4  
When I receive reports with wording like "HP Power Manager is vulnerable to..." I never know if it affects my setup or not. It makes me think that the tester has noticed I have that software, but not tested if I have patched it or not and just used stock answers. "A vulnerability was discovered" is much more likely to get immediate attention as it shows that it is specific to my setup. – Dezza Jan 27 at 9:43
3  
Normally I try to avoid passive voice, but this is a clear exception. The report is not about the method used to find the vulnerabilities, but about the vulnerabilities themselves. That makes the vulnerabilities the subjects of passive-voice sentences. The other approach that works well is the "scholarly we" found in academic papers ("We found vulnerabilities in ..."). Perhaps for variety, one might wish to mix the two. – Monty Harder Jan 27 at 16:18

Typically you'll see them written in first person plural, and less often in third person singular, general. You might do first person singular if you are conducting the work as an individual and not as part of a company.

share|improve this answer

Here's the format I've used. Active voice for things you did, passive voice for the state the system exists in.

At the beginning of the report: $tester (henceforth referred to as "we"/"I") tested $Application ...

For a narrative style: We/I tested the foobar, and found it was vulnerable to baz.

For a findings style: The Foo system is vulnerable to bar. We/I verified it using Baz.

share|improve this answer

If your goal is to be understood, you will use the forms that say most clearly what really happened.

If you performed the action and the pronoun is understood from context, "I discovered" is superior to any alternative for comprehension. Absent necessary context "Paul discovered…" or "Paul Burkeland discovered…" is most clear.

There are answers here that dance around the concepts of what is typical or avoid making the reader feel bad. But if the purpose of communicating is to communicate, pity your reader and prefer clarity above all.

They have to read, an art so difficult that most people don't really master it even after grade school and high school – twelve long years.

So this discussion must finally acknowledge that our stylistic options as writers are neither numerous nor glamorous, since our readers are bound to be such imperfect artists.

— Kurt Vonnegut, Jr. "How to write with style" IEEE Transactions on Professional Communications Vol. PC-24 No. 2 (1981) DOI: 10.1109/TPC.1981.6447837

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.