Primary Audiences
This project is designed for teams that need to transform Qualys CSV exports into a consistent, client-ready HTML deliverable with prioritization support.
Primary audiences
Security teams (consulting, internal AppSec, SecOps)
Security analysts who spend significant time manually triaging Qualys exports and assembling deliverables.
Consultants who need a repeatable way to produce standardized reports across multiple customers.
Security leads who need consistent outputs, predictable turnaround time, and defensible prioritization.
Engineering teams (consumers of the report)
Engineering managers and tech leads who need a clear, scoped remediation shortlist to plan work.
Platform/SRE teams who want predictable artifacts to share internally and optionally plug into operational tooling.
Stakeholders (consumers of the narrative)
Leadership / non-technical stakeholders who benefit from a descriptive narrative alongside technical details.
Customer-facing roles who need a polished deliverable that explains priorities and impact clearly.
When it’s a great fit
You already use Qualys and have CSV exports as the starting point.
You need a Top X shortlist rather than an exhaustive, unfiltered dump of findings.
You want both technical depth and a stakeholder-friendly narrative in the same deliverable.
You run this repeatedly (weekly/monthly, per environment, per customer) and value consistency.
You want an output that’s easy to share: static HTML + assets.
When it may not be the best fit
Your source data is not Qualys CSV (for example, Tenable/Nessus, Burp, OpenVAS) unless you implement/enable a compatible ingestion layer.
You require a full vulnerability management platform (ticketing workflow, RBAC, dashboards, approvals) rather than a report generator.
You cannot use an LLM due to policy constraints and do not want LLM-assisted rationale/narrative (the project can still generate structure, but you’d lose a key value driver).
You need strict data residency controls that cannot be met by your chosen LLM provider setup.
What you should have (baseline expectations)
Access to Qualys exports in CSV format (and permission to process them).
A secure way to provide required secrets (preferably via environment variables).
An agreed internal process for handling sensitive outputs (reports may contain hostnames, IPs, and evidence).