When you're writing a report, what person do you write it as?
First person singular: I discovered a vulnerability in HP Power Manager...
First person plural: We discovered a vulnerability in HP Power Manager...
Third person singular, by name: Bob discovered a vulnerability in HP Power Manager...
Third person singular, general: The tester discovered a vulnerability in HP Power Manager...
Third person singular, attacker: The attacker discovered a vulnerability in HP Power Manager...
Some other options:
Passive voice: A vulnerability in HP Power Manager was discovered...
Present tense: HP Power Manager is vulnerable to...
It is most common (in the UK at least) to use the passive voice. I prefer using present tense when possible, and first person plural otherwise; the writing feels more personal. But this is controversial; a lot of people think reports are supposed to be formal and not at all personal.
Typically you'll see them written in first person plural, and less often in third person singular, general. You might do first person singular if you are conducting the work as an individual and not as part of a company.
Here's the format I've used. Active voice for things you did, passive voice for the state the system exists in.
At the beginning of the report: $tester (henceforth referred to as "we"/"I") tested $Application ...
For a narrative style: We/I tested the foobar, and found it was vulnerable to baz.
For a findings style: The Foo system is vulnerable to bar. We/I verified it using Baz.
If your goal is to be understood, you will use the forms that say most clearly what really happened.
If you performed the action and the pronoun is understood from context, "I discovered" is superior to any alternative for comprehension. Absent necessary context "Paul discovered…" or "Paul Smith discovered…" is most clear.
There are answers here that dance around the concepts of what is typical or avoid making the reader feel bad. But if the purpose of communicating is to communicate, pity your reader and prefer clarity above all.
They have to read, an art so difficult that most people don't really master it even after grade school and high school – twelve long years.
So this discussion must finally acknowledge that our stylistic options as writers are neither numerous nor glamorous, since our readers are bound to be such imperfect artists.
— Kurt Vonnegut, Jr. "How to write with style" IEEE Transactions on Professional Communications Vol. PC-24 No. 2 (1981) DOI: 10.1109/TPC.1981.6447837
