What is a security posture assessment?

In a meeting, "security posture assessment" usually means "someone looked at our security and gave us a number". That is not a method, it is a deliverable. The useful definition is narrower: a repeatable evaluation of a fixed set of controls, performed from a defined vantage point against a defined scope, with a recorded observation supporting each result.

Each part of that sentence is doing work. Repeatable means next quarter's result can be compared with this quarter's. Fixed set of controls means the score cannot be moved by measuring different things. Defined vantage means "the firewall blocks us" is an observation, not a mystery. Recorded observation means you can check the finding without trusting the person who wrote it.

What an external assessment can measure

The catalog behind SMB Scanner Lite has 22 controls in five categories. This is what "external" means concretely: DNS records, mail policy records, a TLS handshake, HTTP response headers, and whether specific high-risk services answer.

Two of those categories are the ones worth acting on first in most small businesses, and neither requires a budget: a domain that anyone can forge, and a remote desktop port open to the internet, are the two findings that most often turn out to matter.

Four statuses, and why the fourth matters

That fourth status is where most assessment tools quietly cheat. Counting "could not tell" as a failure punishes a firewall for doing its job; counting it as a pass rewards silence. Removing it from the calculation and reporting the count separately is the honest option, provided the report shows how many controls actually ran.

Why evidence changes the conversation

A finding without an observation is an opinion. With one, it is a task: here is the TXT record we received, here is the header that was missing, here is the certificate chain and the hostname it covers. Anyone can re-run the query from outside the network and compare. If the answers disagree, the finding is stale or vantage-specific — and that is a legitimate result rather than a broken tool.

It also changes what happens after the report. A developer can verify the problem without asking permission, and a manager can verify the fix without commissioning a second assessment.

In the published recorded assessment, one finding reads like this:

15  Strict-Transport-Security   warning   weight 4
    Evidence: Strict-Transport-Security header not enforced on reference landing page.
    Recommended: send HSTS with max-age of at least one year over HTTPS only.

That is the whole argument: a status, the observation behind it, and the change that would clear it. A reader who disagrees can fetch the headers and say why, which is a better conversation than one about a score.

What it is not

• Not a penetration test. Nothing is exploited, no application logic is tested, and no credentials are used. The comparison covers this properly.
• Not a code review or a vulnerability scan of your application. A missing authorisation check on an invoice page is invisible from outside.
• Not a compliance audit. Frameworks ask whether a control exists and is documented; they do not usually check whether your SPF record is valid today.
• Not a guarantee. A high score means the measured controls met their expectations. It says nothing about the parts nobody measured.

Eight questions to ask before you buy one

1. What exactly is in the catalog, and how many controls does it contain?
2. How is each status assigned, and is the rule published?
3. What does the score weigh, and can I recompute it from the report?
4. Will I get the raw observation behind each finding, or only a severity label?
5. What is explicitly out of scope, in writing?
6. Does it need credentials or any access beyond a public request?
7. Can I re-run it on the same scope at a known interval, and compare results?
8. Who is allowed to be scanned, and how is authorisation recorded?

The answers to those eight questions separate a method from a dashboard. Ours are answered on the methodology page, with the boundary written down on limitations — and the catalog itself is browsable under capabilities.

What SMB Scanner Lite checks here

These are the controls from this area that the assessment evaluates from outside, without credentials and without touching anything private. Each one returns a status and, for every conclusive result, the record, header or handshake that produced it.

Only assess domains you own or are authorised to test — see responsible use. The published recorded assessment shows how a result and its evidence appear in a report, and the control catalog lists all 22 controls with their weights. Reference detail for this topic lives in External security posture assessment: what it measures.