How do I report security findings to a non-technical client?

Lead with consequence, not mechanism. The client is buying reassurance and a decision, not a lesson:

• Say what could happen - “someone could send email that looks like it came from you” beats “your DMARC policy is p=none”.
• Show movement, not just state - what changed since last month is more meaningful than a grade in isolation.
• Separate what you fixed from what needs a decision - the second list should be short and costed.
• Keep the technical detail attached - so their developer or host has what they need.

A report that produces one clear decision is worth more than one that produces forty findings.