Reporting on system security