Primary Audiences

This project is designed for teams that need to transform Qualys CSV exports into a consistent, client-ready HTML deliverable with prioritization support.

Primary audiences

Security teams (consulting, internal AppSec, SecOps)

• Security analysts who spend significant time manually triaging Qualys exports and assembling deliverables.

• Consultants who need a repeatable way to produce standardized reports across multiple customers.

• Security leads who need consistent outputs, predictable turnaround time, and defensible prioritization.

Engineering teams (consumers of the report)

• Engineering managers and tech leads who need a clear, scoped remediation shortlist to plan work.

• Platform/SRE teams who want predictable artifacts to share internally and optionally plug into operational tooling.

Stakeholders (consumers of the narrative)

• Leadership / non-technical stakeholders who benefit from a descriptive narrative alongside technical details.

• Customer-facing roles who need a polished deliverable that explains priorities and impact clearly.

When it’s a great fit

• You already use Qualys and have CSV exports as the starting point.

• You need a Top X shortlist rather than an exhaustive, unfiltered dump of findings.

• You want both technical depth and a stakeholder-friendly narrative in the same deliverable.

• You run this repeatedly (weekly/monthly, per environment, per customer) and value consistency.

• You want an output that’s easy to share: static HTML + assets.

When it may not be the best fit

• Your source data is not Qualys CSV (for example, Tenable/Nessus, Burp, OpenVAS) unless you implement/enable a compatible ingestion layer.

• You require a full vulnerability management platform (ticketing workflow, RBAC, dashboards, approvals) rather than a report generator.

• You cannot use an LLM due to policy constraints and do not want LLM-assisted rationale/narrative (the project can still generate structure, but you’d lose a key value driver).

• You need strict data residency controls that cannot be met by your chosen LLM provider setup.

What you should have (baseline expectations)

• Access to Qualys exports in CSV format (and permission to process them).

• A secure way to provide required secrets (preferably via environment variables).

• An agreed internal process for handling sensitive outputs (reports may contain hostnames, IPs, and evidence).

Typical outcomes for teams adopting it

• Faster report turnaround with less analyst effort.

• More consistent prioritization across runs and customers.

• Clearer handoff to Engineering with a scoped remediation shortlist.

• Better stakeholder communication through a descriptive narrative layer.