diff --git a/lib/reporting/protocols_report.rb b/lib/reporting/protocols_report.rb
new file mode 100644
index 00000000000..14c755dbe30
--- /dev/null
+++ b/lib/reporting/protocols_report.rb
@@ -0,0 +1,227 @@
+# frozen_string_literal: true
+
+require 'csv'
+begin
+  require 'reporting/cloudwatch_client'
+  require 'reporting/cloudwatch_query_quoting'
+  require 'reporting/command_line_options'
+rescue LoadError => e
+  warn 'could not load paths, try running with "bundle exec rails runner"'
+  raise e
+end
+
+module Reporting
+  class ProtocolsReport
+    include Reporting::CloudwatchQueryQuoting
+
+    attr_reader :time_range
+
+    SAML_AUTH_EVENT = 'SAML Auth'
+    OIDC_AUTH_EVENT = 'OpenID Connect: authorization request'
+
+    # @param [Range<Time>] time_range
+    def initialize(
+      issuers:,
+      time_range:,
+      verbose: false,
+      progress: false,
+      slice: 1.day,
+      threads: 10
+    )
+      @issuers = issuers
+      @time_range = time_range
+      @verbose = verbose
+      @progress = progress
+      @slice = slice
+      @threads = threads
+    end
+
+    def verbose?
+      @verbose
+    end
+
+    def progress?
+      @progress
+    end
+
+    def as_tables
+      [
+        overview_table,
+        protocols_table,
+        saml_signature_issues_table,
+      ]
+    end
+
+    def as_emailable_reports
+      [
+        Reporting::EmailableReport.new(
+          title: 'Overview',
+          table: overview_table,
+        ),
+        Reporting::EmailableReport.new(
+          title: 'State of Authentication',
+          table: protocols_table,
+        ),
+        Reporting::EmailableReport.new(
+          title: 'SAML Signature Issues',
+          table: saml_signature_issues_table,
+        ),
+      ]
+    end
+
+    def to_csvs
+      as_tables.map do |table|
+        CSV.generate do |csv|
+          table.each do |row|
+            csv << row
+          end
+        end
+      end
+    end
+
+    def protocol_data
+      @protocol_data ||= begin
+        protocol_counts = Hash.new(0)
+        cloudwatch_client.fetch(
+          query: protocol_query,
+          from: time_range.begin,
+          to: time_range.end,
+        ).each do |row|
+          protocol_counts[row['protocol']] += row['request_count'].to_i
+        end
+        protocol_counts
+      end
+    end
+
+    def saml_signature_data
+      @saml_signature_data ||= begin
+        results = cloudwatch_client.fetch(
+          query: saml_signature_query,
+          from: time_range.begin,
+          to: time_range.end,
+        )
+        {
+          unsigned: results.
+            select { |slice| slice['unsigned_count'].to_i > 0 }.
+            map { |slice| slice['issuer'] }.
+            uniq,
+          invalid_signature: results.
+            select { |slice| slice['invalid_signature_count'].to_i > 0 }.
+            map { |slice| slice['issuer'] }.
+            uniq,
+        }
+      end
+    end
+
+    def protocol_query
+      params = {
+        event: quote([SAML_AUTH_EVENT, OIDC_AUTH_EVENT]),
+      }
+
+      format(<<~QUERY, params)
+        fields
+          name AS protocol
+        | filter name IN %{event}
+        | stats
+          count(*) AS request_count
+          BY
+          protocol
+      QUERY
+    end
+
+    def saml_signature_query
+      params = {
+        event: quote([SAML_AUTH_EVENT]),
+      }
+
+      format(<<~QUERY, params)
+        fields
+          properties.event_properties.service_provider AS issuer,
+          properties.event_properties.request_signed = 1 AS signed,
+          properties.event_properties.request_signed != 1 AS not_signed,
+          isempty(properties.event_properties.matching_cert_serial) AND signed AS invalid_signature
+        | filter name IN %{event}
+          AND properties.event_properties.success = 1
+        | stats
+          sum(not_signed) AS unsigned_count,
+          sum(invalid_signature) AS invalid_signature_count
+          BY
+          issuer
+        | sort
+          issuer
+      QUERY
+    end
+
+    def cloudwatch_client
+      @cloudwatch_client ||= Reporting::CloudwatchClient.new(
+        num_threads: @threads,
+        ensure_complete_logs: true,
+        slice_interval: @slice,
+        progress: progress?,
+        logger: verbose? ? Logger.new(STDERR) : nil,
+      )
+    end
+
+    def overview_table
+      [
+        ['Report Timeframe', "#{time_range.begin} to #{time_range.end}"],
+        # This needs to be Date.today so it works when run on the command line
+        ['Report Generated', Date.today.to_s], # rubocop:disable Rails/Date
+      ]
+    end
+
+    def saml_count
+      protocol_data[SAML_AUTH_EVENT]
+    end
+
+    def oidc_count
+      protocol_data[OIDC_AUTH_EVENT]
+    end
+
+    def protocols_table
+      [
+        ['Authentication Protocol', '% of attempts', 'Total number'],
+        [
+          'SAML',
+          to_percent(saml_count, saml_count + oidc_count),
+          saml_count,
+        ],
+        [
+          'OIDC',
+          to_percent(oidc_count, saml_count + oidc_count),
+          oidc_count,
+        ],
+      ]
+    end
+
+    def saml_signature_issues_table
+      [
+        ['Issue', 'Count of integrations with the issue', 'List of issuers with the issue'],
+        [
+          'Not signing SAML authentication requests',
+          saml_signature_data[:unsigned].length,
+          saml_signature_data[:unsigned].join(', '),
+        ],
+        [
+          'Incorrectly signing SAML authentication requests',
+          saml_signature_data[:invalid_signature].length,
+          saml_signature_data[:invalid_signature].join(', '),
+        ],
+      ]
+    end
+
+    def to_percent(numerator, denominator)
+      (100.0 * numerator / denominator).round(2)
+    end
+  end
+end
+
+# rubocop:disable Rails/Output
+if __FILE__ == $PROGRAM_NAME
+  options = Reporting::CommandLineOptions.new.parse!(ARGV, require_issuer: false)
+
+  Reporting::ProtocolsReport.new(**options).to_csvs.each do |csv|
+    puts csv
+  end
+end
+# rubocop:enable Rails/Output
diff --git a/spec/lib/reporting/protocols_report_spec.rb b/spec/lib/reporting/protocols_report_spec.rb
new file mode 100644
index 00000000000..dcc5ef29ca4
--- /dev/null
+++ b/spec/lib/reporting/protocols_report_spec.rb
@@ -0,0 +1,189 @@
+require 'rails_helper'
+require 'reporting/protocols_report'
+
+RSpec.describe Reporting::ProtocolsReport do
+  let(:time_range) { Date.new(2022, 1, 1).all_day }
+
+  subject(:report) { Reporting::ProtocolsReport.new(issuers: nil, time_range:) }
+
+  before do
+    protocol_query_response = [
+      {
+        'protocol' => 'SAML Auth',
+        'request_count' => '8',
+      },
+      {
+        'protocol' => 'SAML Auth',
+        'request_count' => '2',
+      },
+      {
+        'protocol' => 'SAML Auth',
+        'request_count' => '10',
+      },
+      {
+        'protocol' => 'OpenID Connect: authorization request',
+        'request_count' => '80',
+      },
+    ]
+    saml_signature_query_response = [
+      {
+        'issuer' => 'Issuer1',
+        'unsigned_count' => '2',
+        'invalid_signature_count' => '0',
+      },
+      {
+        'issuer' => 'Issuer1',
+        'unsigned_count' => '5',
+        'invalid_signature_count' => '0',
+      },
+      {
+        'issuer' => 'Issuer3',
+        'unsigned_count' => '3',
+        'invalid_signature_count' => '0',
+      },
+      {
+        'issuer' => 'Issuer2',
+        'unsigned_count' => '0',
+        'invalid_signature_count' => '0',
+      },
+      {
+        'issuer' => 'Issuer1',
+        'unsigned_count' => '8',
+        'invalid_signature_count' => '2',
+      },
+    ]
+    cloudwatch_client = instance_double('Reporting::CloudwatchClient')
+    allow(cloudwatch_client).to receive(:fetch).and_return(
+      protocol_query_response,
+      saml_signature_query_response,
+    )
+
+    allow(report).to receive(:cloudwatch_client).and_return(cloudwatch_client)
+  end
+
+  describe '#as_tables' do
+    it 'generates the tabular csv data' do
+      expect(report.as_tables).to eq expected_tables
+    end
+  end
+
+  describe '#as_emailable_reports' do
+    it 'adds a "first row" hash with a title for tables_report mailer' do
+      reports = report.as_emailable_reports
+      aggregate_failures do
+        reports.each do |report|
+          expect(report.title).to be_present
+        end
+      end
+    end
+  end
+
+  describe '#to_csvs' do
+    it 'generates a csv' do
+      csv_string_list = report.to_csvs
+      expect(csv_string_list.count).to be 3
+
+      csvs = csv_string_list.map { |csv| CSV.parse(csv) }
+
+      aggregate_failures do
+        csvs.map(&:to_a).zip(expected_tables(strings: true)).each do |actual, expected|
+          expect(actual).to eq(expected)
+        end
+      end
+    end
+  end
+
+  describe '#cloudwatch_client' do
+    let(:opts) { {} }
+    let(:subject) { described_class.new(issuers: nil, time_range:, **opts) }
+    let(:default_args) do
+      {
+        num_threads: 10,
+        ensure_complete_logs: true,
+        slice_interval: 1.day,
+        progress: false,
+        logger: nil,
+      }
+    end
+
+    describe 'when all args are default' do
+      it 'creates a client with the default options' do
+        expect(Reporting::CloudwatchClient).to receive(:new).with(default_args)
+
+        subject.cloudwatch_client
+      end
+    end
+
+    describe 'when verbose is passed in' do
+      let(:opts) { { verbose: true } }
+      let(:logger) { double Logger }
+
+      before do
+        expect(Logger).to receive(:new).with(STDERR).and_return logger
+        default_args[:logger] = logger
+      end
+
+      it 'creates a client with the expected logger' do
+        expect(Reporting::CloudwatchClient).to receive(:new).with(default_args)
+
+        subject.cloudwatch_client
+      end
+    end
+
+    describe 'when progress is passed in as true' do
+      let(:opts) { { progress: true } }
+      before { default_args[:progress] = true }
+
+      it 'creates a client with progress as true' do
+        expect(Reporting::CloudwatchClient).to receive(:new).with(default_args)
+
+        subject.cloudwatch_client
+      end
+    end
+
+    describe 'when threads is passed in' do
+      let(:opts) { { threads: 17 } }
+      before { default_args[:num_threads] = 17 }
+
+      it 'creates a client with the expected thread count' do
+        expect(Reporting::CloudwatchClient).to receive(:new).with(default_args)
+
+        subject.cloudwatch_client
+      end
+    end
+
+    describe 'when slice is passed in' do
+      let(:opts) { { slice: 2.weeks } }
+      before { default_args[:slice_interval] = 2.weeks }
+
+      it 'creates a client with expected time slice' do
+        expect(Reporting::CloudwatchClient).to receive(:new).with(default_args)
+
+        subject.cloudwatch_client
+      end
+    end
+  end
+
+  def expected_tables(strings: false)
+    [
+      [
+        ['Report Timeframe', "#{time_range.begin} to #{time_range.end}"],
+        ['Report Generated', Date.today.to_s], # rubocop:disable Rails/Date
+      ],
+      [
+        ['Authentication Protocol', '% of attempts', 'Total number'],
+        ['SAML', string_or_num(strings, 20.0), string_or_num(strings, 20)],
+        ['OIDC', string_or_num(strings, 80.0), string_or_num(strings, 80)],
+      ],
+      [
+        ['Issue', 'Count of integrations with the issue', 'List of issuers with the issue'],
+        ['Not signing SAML authentication requests', string_or_num(strings, 2), 'Issuer1, Issuer3'],
+        ['Incorrectly signing SAML authentication requests', string_or_num(strings, 1), 'Issuer1'],
+      ],
+    ]
+  end
+
+  def string_or_num(strings, value)
+    strings ? value.to_s : value
+  end
+end