transilience-report-style

Transilience AI — Threat Intelligence Report Design System

Version: 5.0 — Light theme (modern, minimal, professional)
Format: PDF (A4), ReportLab
Last Updated: July 7, 2026

---

0. Theme (v5.0)

The report now renders a light theme by default (white page, dark ink, brand accents). Both palettes live in the THEME dict in generate_report.py; select with --theme light|dark (or engagement.theme). Precedence: --theme > engagement.theme > light; an unknown value falls back to light (never errors). The pentest-engagement finalize gate passes no --theme, so all gated PDFs are light. The sections below marked "(dark fallback)" describe the retained --theme dark palette.

0.1 Light palette (brand: purple #6941C6 → magenta #C9317C)

0.2 What v5 adds / changes

• Light, airy layout — white surfaces, hairline separators, generous padding/leading; colour used only semantically (severity / score / status).
• Colour-coded risk & score — severity via the finding-card left stripe + [SEV] tag; and in every risk table (findings summary, CVE register, per-finding CVE table) both the severity label and the CVSS score cell are band-coloured + bold — the label by its severity, the score by score_band(score). tbl(..., sevcol=, scorecol=) selects the columns; the colour is emitted as an inline <font> tag inside the cell (a TableStyle TEXTCOLOR is ignored on ReportLab Paragraph cells, so it must live in the cell markup). Empty/non-numeric score cells stay uncoloured.
• Highlighted code/samples — codebox() renders CVSS vectors, PoC/test requests, affected assets, and endpoints in a bordered light-grey monospace block; screenshots are framed with a border + caption.
• Finding cards are a single-column multi-row Table (severity left-stripe + hairline box + padding) so tall Critical findings split cleanly across pages (border redrawn per fragment).
• Logo is drawn at its true aspect ratio (1024×468 → 0.457; ~48mm wide) — never squished.
• Graphical (severity-bar chart) + Tabular (findings index) summaries, DURATION cover row, per-finding Ease of Exploitation + References, and a Conclusion section are all light-themed.

---

1. Page & Document Configuration

---

2. Typography

2.1 Font Stack

Family Registration: Carlito is registered as a full family (normal, bold, italic, boldItalic) enabling automatic style switching via ReportLab's <b> and <i> XML tags.

2.2 Type Scale

2.3 Advisory Card Typography

---

3. Color Palette

3.1 Backgrounds — dark fallback (--theme dark; light palette in §0.1)

3.2 Brand Colors

3.3 Text Colors

3.4 Severity Colors

3.5 Accent Colors

3.6 Gradient Specification

The brand gradient is a linear interpolation between two endpoints used across multiple components:

Rendered as: 80 discrete steps, left-to-right. Used in: page top rule (3.5pt), section dividers (2pt), cover separators (3pt), progress bars, card bottom dividers.

---

4. Component Library

4.1 GradientLine

A full-width or partial-width horizontal rule using the brand gradient.

4.2 GradientBar

A proportional progress bar with gradient fill and rounded track.

4.3 CardBox

A bordered container with optional accent sidebar. Used for posture items, recommendations, methodology phases.

4.4 MetricBox

A compact KPI display used in the executive summary row.

4.5 SeverityBadge

A colored pill showing severity level.

4.6 SectionNumber

A large decorative section number with ghost double-strike effect.

4.7 ScoreRow

Three horizontal inline score bars stacked vertically.

Dynamic color rules:

4.8 AccentBar (Card Top)

A thin colored bar at the top of each advisory card.

4.9 TechStackBlock

A category block displaying technology items as a bulleted list.

---

5. Page Template

Applied to every page via the page-template onPage hook. Light default: white page fill, a 2.5pt brand gradient hairline at the very top, and a hairline-ruled footer (muted text + purple page number) — no dark footer bar. The dark-fallback specifics below apply under --theme dark.

5.1 Background Fill

• Full page PAGE rectangle — #FFFFFF light · #07040B under --theme dark

5.2 Top Gradient Rule

• Brand gradient (80 steps, BP → BM), 3.5pt height, full page width, positioned at page top

5.3 Footer Bar

5.4 Left Accent Strip

• 2.5pt wide vertical bar, full page height minus footer, rgba(105, 65, 198, 0.12), positioned at x=0

---

6. Radar Visualization

A custom Flowable rendering a polar threat radar.

6.1 Dimensions

6.2 Background Glow

Concentric filled circles from max_r + 20 down to 0 (step −2), each with increasing alpha (0.03 → 0.05), color rgba(10, 5, 20, alpha).

6.3 Ring Grid

4 dashed concentric rings at 25%, 50%, 75%, 100% of max radius.

• Ring stroke: rgba(105, 65, 198, 0.3), 0.5pt, dash pattern (3, 3)
• Labels positioned along 15° angle from center at each ring's radius, Poppins-Medium 7pt

6.4 Sector Spokes

12 spokes at 30° intervals, representing attack surfaces:

Web Apps/API, Cloud/Infra, Network, Endpoints, Email, Mobile, IoT/OT, Data Storage, Identity, Third-Party, Physical, Social Eng.

• Spoke stroke: rgba(105, 65, 198, 0.25), 0.3pt
• Labels: Poppins-Medium 9pt, white, at max_r + 32 from center
• Alignment: centered if near vertical, left-aligned if right half, right-aligned if left half

6.5 Center Crosshair

• 16pt arms, color rgba(140, 92, 230, 0.4), 0.4pt
• Center glow: 16 concentric circles, rgba(105, 65, 198, 0.04 × (16−r))

6.6 Threat Points

Each threat plotted using theta_deg and radius_norm from data.

Three-layer rendering per point:

1. Outer glow: severity color at 0.12 alpha, radius + 7pt
2. Mid glow: severity color at 0.25 alpha, radius + 3pt
3. Core dot: severity color at 0.9 alpha, exact radius
4. Specular highlight: white at 0.3 alpha, offset (−0.15r, +0.15r), radius 0.35r

---

7. Advisory Card Structure

Cards are returned as flat lists of Flowables (not wrapped in CardBox), enabling ReportLab page-split. Between cards: CondPageBreak(220) — only breaks if <220pt space remains.

7.1 Card Layout (top to bottom)

7.2 Metadata Row Format

Source: THREAT INTEL │ Surface: Endpoint / Email │ Status: NEW │ First Seen: 2026-02-24

Labels in BPL (#8B5CF6), values in T2, separator: unicode │ (U+2502) with 4-space padding.

Source label mapping: threat → THREAT INTEL, product → PRODUCT VULN, breach → BREACH INTEL.

7.3 Detection Evidence Format

• {TechName}  —  {evidence_string}

Tech name in T1 (white, bold), em-dash separator, evidence string in T2. Max 6 items per card.

7.4 Section Header Coloring

---

8. Cover Page Layout

8.1 Structure (top to bottom)

8.2 Metadata Fields

---

9. Table of Contents Layout

---

10. Report Section Blueprint

10.1 Standard Section Header Pattern

Every numbered section follows this sequence:

1. SectionNumber(num) — decorative ghost number (38pt height)
2. Section title in h1 style (Poppins-Bold 20pt)
3. GradientLine(CW, 2) — full-width separator
4. Spacer(1, 4*mm) — breathing room

10.2 Section Inventory (12 sections)

---

11. Spacing System

11.1 Vertical Rhythm

11.2 Table Padding

---

12. Data-Driven Components

12.1 Evidence Map Architecture

Technology evidence is extracted from techstack_report.json and indexed by keyword. The extraction traverses:

• technologies.frontend[] — name, evidence[].finding, evidence[].details
• technologies.backend[] — web servers, frameworks, CMS, languages
• technologies.infrastructure[] — DNS, CDN providers
• technologies.security[] — WAF, certificates, headers, email security
• technologies.third_party[] — analytics, collaboration tools

Each evidence item is indexed under multiple keywords derived from the technology name fragments. Alias mappings expand coverage (e.g., email → proofpoint, microsoft, dmarc).

12.2 Threat-Evidence Matching

get_threat_evidence(threat) scans the threat's title, summary, and threat_name against the keyword index. Returns up to 6 (tech_name, evidence_string) tuples. Deduplication by {tech_name}:{evidence} key.

12.3 Severity Sorting

All threats sorted by: severity rank descending (critical=4, high=3, medium=2, low=1), then prioritization_score descending. Split into four lists for section rendering.

---

13. Unicode Characters

---

14. Adaptive Behaviors

14.1 Page Break Strategy

14.2 Card Splittability

Advisory cards return flat list[Flowable] instead of monolithic CardBox. This allows ReportLab's frame to split cards across page boundaries at any Paragraph/Spacer seam, eliminating blank pages.

14.3 Client Adaptation

The design system is client-agnostic. Customized per client:

• Cover: client logo, name, sector, region, report ID
• Executive summary: narrative and key findings
• Attack surface: domain/subdomain inventory
• Evidence map: keyword aliases tuned to client's tech stack
• Security posture: assessments specific to client's infrastructure
• Recommendations: actionable items specific to client's vulnerabilities

All visual elements (colors, typography, spacing, components) remain identical across clients.