Limitations
What an external assessment cannot tell you.
This page exists because a security product that only describes its strengths is not giving you a usable picture. These are the limits of the method, the tool and the evidence it produces — stated plainly, and reflected in how findings are worded.
1. Scope is external and unauthenticated
SMB Scanner Lite answers questions from the public internet, without credentials. It cannot see anything behind a login: applications, customer portals, admin interfaces that require a session, internal APIs, databases on a private network, directory services, endpoints or backups.
A clean external result therefore means the measured external controls looked correct at that moment. It says nothing about what is happening behind the login screen.
2. A failed control is not a proven vulnerability
When a control fails, it means the published expectation was not met — a DMARC policy set to p=none, an absent Content-Security-Policy, an SMB negotiate answered on port 445. None of these is an exploit. Proving exploitability requires attempting exploitation, which this tool never does, and which requires separate written authorisation.
3. It cannot detect compromise
External observation cannot establish whether a system has been breached, whether an account is compromised, or whether data has been exfiltrated. It can highlight exposure that often precedes those outcomes. That is a different claim, and the report keeps them separate.
4. Results depend on the vantage point
A DNS record can resolve differently for different resolvers. A firewall can answer one source address and drop another. A CDN can present different security headers on different routes. A finding is an observation made from one place at one time, which is why every finding quotes the observation rather than only the verdict.
5. A finding describes a moment
Configuration changes. A certificate valid at assessment time may expire next week; a header added yesterday may not appear in an older report. Always check the assessment timestamp before acting on a result, and re-assess after changes.
6. Silence is not evidence
Some controls will return no conclusive answer: rate limiting, geo-blocking, filtering or a slow endpoint. Those results are marked inconclusive and excluded from the score. They are not converted into failures, and they are not counted as passes.
7. The public edition runs a subset
The published sandbox executes eight controls across DNS, email authentication, transport and browser headers. The remaining controls belong to the private engine and are not executed publicly. A sandbox score is therefore not directly comparable to a full 22-control assessment, and the site says so wherever a sandbox score appears.
8. It is not an audit, a certification or a guarantee
The output is not an ISO 27001 assessment, not a SOC 2 opinion, not a penetration-test report and not a compliance certificate. It does not certify that a business is secure, and no result from this tool should be presented as such to a customer, regulator or insurer.
9. A sandbox report is a demonstration
Reports produced by the public sandbox against its five reserved test domains are educational output. They are not commercial assessments of those domains, and they must not be represented as such.
How to use a result responsibly. Treat every finding as a reason to look, not a verdict. Verify the observation from your own network, prioritise by the exposure it creates, and record what you changed. The report is a starting point for a conversation with someone who can act on it.
Want the full 22-control assessment instead of the sandbox?
A private assessment covers your domain, with scope and written authorisation agreed first.