At Bayora, a useful finding shows how often an attack worked, how reproducible it was and what it led to. 92 successes in 100 runs means a 92% observed attack success rate for that setup, with confidence reported separately. We also map the attack path, such as prompt injection leading to an unauthorised tool call and data exposure. On expected behaviours, do you mean plain language rules or structured test cases for allowed actions and data access?
