A system and method for performing security assessments in an online services system. In one embodiment, the method includes receiving a list of target data for a report; and generating fields in the report. The method also includes populating the fields with composite information; receiving a command to execute the report; fetching the target data using the composite information; and populating the report with the target data.