Before attempting to build the right foundation for comprehensive application security risk reporting, consider eight questions.
https://www.securitymagazine.com/articles/96118-8-tough-questions-to-drive-the-right-appsec-reporting-solution-and-devsecops