When you're writing a report, what person do you write it as?

First person singular: I discovered a vulnerability in HP Power Manager...

First person plural: We discovered a vulnerability in HP Power Manager...

Third person singular, by name: Bob discovered a vulnerability in HP Power Manager...

Third person singular, general: The tester discovered a vulnerability in HP Power Manager...

Third person singular, attacker: The attacker discovered a vulnerability in HP Power Manager...

  • 102
    What, no love for 16th century second person singular? "Thou hast run Nessus against the bastion host..." Jan 27, 2016 at 5:26
  • 6
    this belongs on english.SE? Jan 27, 2016 at 7:03
  • 11
    Definitely not, @limbenjamin. Writers SE, possibly. They have a tag for technical writing.
    – TRiG
    Jan 27, 2016 at 10:52

4 Answers 4


Some other options:

Passive voice: A vulnerability in HP Power Manager was discovered...

Present tense: HP Power Manager is vulnerable to...

It is most common (in the UK at least) to use the passive voice. I prefer using present tense when possible, and first person plural otherwise; the writing feels more personal. But this is controversial; a lot of people think reports are supposed to be formal and not at all personal.

  • 9
    +HP Power Manager has been found vulnerable to... Jan 27, 2016 at 5:47
  • 1
    I think it's really depends on the company. I remember when I was at school I was taught to use the passive voice for reports, then one day I took a class where I lost marks for using it and was told to use the active voice.
    – Celeritas
    Jan 27, 2016 at 5:47
  • 12
    Reports I've seen tend to be in passive past tense - avoids judgement, and suggests that the subject of the report might have fixed it since the test was carried out, because they are on the ball and efficient.
    – Matthew
    Jan 27, 2016 at 7:02
  • 4
    When I receive reports with wording like "HP Power Manager is vulnerable to..." I never know if it affects my setup or not. It makes me think that the tester has noticed I have that software, but not tested if I have patched it or not and just used stock answers. "A vulnerability was discovered" is much more likely to get immediate attention as it shows that it is specific to my setup.
    – Dezza
    Jan 27, 2016 at 9:43
  • 3
    Normally I try to avoid passive voice, but this is a clear exception. The report is not about the method used to find the vulnerabilities, but about the vulnerabilities themselves. That makes the vulnerabilities the subjects of passive-voice sentences. The other approach that works well is the "scholarly we" found in academic papers ("We found vulnerabilities in ..."). Perhaps for variety, one might wish to mix the two. Jan 27, 2016 at 16:18

Typically you'll see them written in first person plural, and less often in third person singular, general. You might do first person singular if you are conducting the work as an individual and not as part of a company.


Here's the format I've used. Active voice for things you did, passive voice for the state the system exists in.

At the beginning of the report: $tester (henceforth referred to as "we"/"I") tested $Application ...

For a narrative style: We/I tested the foobar, and found it was vulnerable to baz.

For a findings style: The Foo system is vulnerable to bar. We/I verified it using Baz.


If your goal is to be understood, you will use the forms that say most clearly what really happened.

If you performed the action and the pronoun is understood from context, "I discovered" is superior to any alternative for comprehension. Absent necessary context "Paul discovered…" or "Paul Smith discovered…" is most clear.

There are answers here that dance around the concepts of what is typical or avoid making the reader feel bad. But if the purpose of communicating is to communicate, pity your reader and prefer clarity above all.

They have to read, an art so difficult that most people don't really master it even after grade school and high school – twelve long years.

So this discussion must finally acknowledge that our stylistic options as writers are neither numerous nor glamorous, since our readers are bound to be such imperfect artists.

— Kurt Vonnegut, Jr. "How to write with style" IEEE Transactions on Professional Communications Vol. PC-24 No. 2 (1981) DOI: 10.1109/TPC.1981.6447837

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .