Generate the Client Deliverable Kit — three client-ready PDFs, the MITRE ATT&CK Navigator bundle, and a ZIP.

deliver renders the PRO Client Deliverable Kit from a workspace a scan already filled, and packages it as a single ZIP. It is a PRO command: in LITE it prints the upgrade panel and exits without rendering.

It works from the host launcher and from inside the interactive shell. Inside the shell the active workspace is used automatically, so --workspace is only needed from the host.

adscan deliver [--workspace NAME] [--client NAME] [--engagement CODE]
               [--only LIST] [--frameworks LIST] [--theme THEME]
               [--client-logo PATH] [--output DIR] [--no-navigator]

What it generates

Three PDFs, plus the Navigator extras:

File	Audience	What it carries
`Security_Assessment_Report.pdf`	CISO, board	The headline document: posture score, findings with severity and location, the validated attack paths, the ATT&CK lens, and a recommended fix per finding.
`AD_Hardening_Playbook.pdf`	Security team lead	Remediation runbooks indexed by finding ID (approach, steps, commands, validation) and a 30-day prioritized plan with owners.
`AD_Control_Coverage_Report.pdf`	Auditors, procurement	What was tested and what the client is verified clear on, mapped to control codes across the frameworks you selected.

Alongside them, unless you pass --no-navigator: an ATT&CK Navigator layer (navigator-layer.json), a standalone HTML viewer, and a diff layer against the previous scan when one exists.

The MITRE Remediation Checklist was retired

It used to ship as a fourth PDF. Its technique-by-technique ATT&CK lens now lives inside the Security Assessment Report, so the kit carries the same coverage in fewer documents. --only checklist still resolves — it renders the assessment report — so a pinned script does not break.

Selecting deliverables

--only takes a comma-separated list. Omit it to render everything.

Selector	Renders
`report`	Security Assessment Report
`playbook`	AD Hardening Playbook
`coverage-matrix`	AD Control Coverage Report
`executive`	Deprecated alias for `report`
`checklist`	Deprecated alias for `report`

# Just the playbook
adscan deliver --workspace acme.local --only playbook

# Report plus playbook, skipping the coverage report
adscan deliver --workspace acme.local --only report,playbook

Compliance frameworks

No framework is selected by default

--frameworks has no default. If you neither pass the flag nor pick anything at the prompt, the kit still renders — but the Control Coverage Report comes out with no compliance mapping, because no regime was requested. Nothing is forced onto a report that did not ask for it: a client who needs PCI DSS and ISO 27001 should not receive an ENS section.

Key	Framework
`ens`	ENS Alto — Spain / CCN-CERT
`nis2`	NIS2 — EU Directive (EU) 2022/2555
`iso27001`	ISO/IEC 27001:2022
`dora`	DORA — EU 2022/2554
`pci_dss`	PCI DSS v4.0.1

ENS and NIS2 are distinct regimes and are selected independently — ask for both with --frameworks ens,nis2.

In an interactive terminal, omitting the flag opens a checkbox prompt. In a non-interactive run (adscan ci, the web worker, a pipeline) there is no prompt, so pass the flag explicitly or accept a kit with no compliance section.

adscan deliver --workspace acme.local --frameworks iso27001,pci_dss

Theme

--theme sets the visual treatment for the whole kit. Two themes are supported:

Value	Look
`corporate_light`	White and navy, print-safe. The Big-4 / auditor register. Default.
`editorial`	Warm bone paper with an ember accent. The premium consultancy register.

Short aliases light, warm and dark are accepted. ADSCAN_PDF_THEME sets it for every run. An unrecognized value falls back to the default rather than failing the render — the kit always produces something.

--report-theme is the older spelling of the same flag and still works.

Client logo

--client-logo co-brands the report cover with the client's own logo, placed next to the ADscan mark. It accepts PNG, SVG and JPG. Use a logo with a transparent background so it sits cleanly on the cover; a logo with its own solid background shows as a visible box.

In an interactive run you can omit the flag: ADscan asks whether to add a logo and opens a host file picker. Pass the flag to point straight at the file instead. Either way the choice is saved to config.json, so later deliver and ci runs reuse it without asking again.

The ADscan mark stays on the cover. Removing it for a fully white-labelled report is a separate paid capability.

adscan deliver --workspace acme.local --client-logo ~/branding/acme.png

Other flags

Flag	Effect
`--workspace NAME`	Workspace name or path. Defaults to the active shell workspace, or prompts.
`--client NAME`	Client name embedded in the kit metadata.
`--engagement CODE`	Engagement code embedded in the kit metadata.
`--output DIR`	Override the output directory.
`--no-navigator`	Skip the ATT&CK Navigator layer, HTML viewer and diff.
`-d`, `--debug`	Debug output.

--client and --engagement are optional; left blank they render as an em rule in the metadata. Supplied together on an interactive run, they skip the prompt that would otherwise ask for both.

Output

<workspace>/deliverables/
├── <YYYY-MM-DD>-adscan-kit.zip     the kit, ready to send
├── manifest.json                    file sizes, paths, and the selection
└── staging/                         the rendered files, unzipped
    ├── Security_Assessment_Report.pdf
    ├── AD_Hardening_Playbook.pdf
    ├── AD_Control_Coverage_Report.pdf
    ├── navigator-layer.json
    ├── navigator.html
    └── affected_assets_appendix.{csv,json}

The PDFs render concurrently, so the wall-clock cost is roughly the slowest document rather than the sum.

Example

adscan deliver \
  --workspace acme.local \
  --client "Acme Corp" \
  --engagement ACME-2026-Q1 \
  --frameworks iso27001,dora \
  --theme editorial

Client Deliverable Kit — what each document contains.
Generate a report — the interactive and CI paths to the same output.
adscan ci — rendering the report as part of an unattended run.

adscan deliver

On this page