Blog · Assessment and scoring
Assessment, scoring and reports
A score is only useful if you can explain where it came from. These guides cover the method behind the number, what the number cannot tell you, and what to do in the week after you receive one.
Assessment is a genre with a credibility problem: plenty of reports, very little that a reader can check. The method here is deliberately narrow. It measures a fixed catalog of publicly observable controls, records the observation behind every conclusive finding, and states its limits in the same document as its findings.
That makes the output less impressive and considerably more useful. You can re-run a query, reproduce a finding, and tell whether last quarter's fix actually held.
Every post in this cluster ends with the same question: what would you do on Monday? Where a check can be run by hand, the command is in the post. Where it cannot, the post says so rather than implying a tool will handle it.
Reference article
For the specification-level detail behind these guides — mechanisms, edge cases and what the standard does not cover:
External security posture assessment: what it measuresGuides
4 posts in this cluster.
Newest first.
What is a security posture assessment?
A working definition, the five categories an external assessment can actually measure, and eight questions to ask before you buy one from anybody.
External security assessment vs penetration testing
Breadth against depth, configuration against exploitation. What each engagement actually tests, when you need which, and how the two fit together in a year.
How to check your company's external security posture for free
A twenty-five minute routine you can run yourself, what to write down, and the honest limits of a manual pass compared with a scored assessment.
How to read your SMB Scanner Lite report
A guided tour of the report: metadata and consent record, the score and its arithmetic, evidence strings, inconclusive results, and the order to fix things in.
What the tool checks
The controls this cluster maps to.
Pulled from the published 22-control catalog, with the weights that drive the posture score.
| Control | What is evaluated |
|---|---|
| 22 controls, five categories | DNS, email authentication, TLS, browser headers and service exposure, each weighted 1-5. |
| Four statuses | Pass, warning, fail and inconclusive, with inconclusive excluded from the score rather than counted as failure. |
| Evidence on every finding | The record, header or handshake that produced the result, quoted so it can be re-checked. |
| Grade bands | A 90-100, B 80-89, C 65-79, D 50-64, F below 50, applied to the weighted mean. |
Other clusters
Keep going elsewhere
Check this area on your own domain.
The assessment covers all five clusters, with the observation quoted behind every conclusive finding.