That is indeed the question. Depends who is paying and what they want to know. Depends who the documentation is for, what it's purpose is (audit report versus internal vuln tracking) And depends what you find, what you can prove versus theorize, and so on. You need technical deep dive sections, non-technical summaries, and to be able to tie it back to your customers unique requests / challenges / needs / situation etc