Knowledge base
Technical writing for people who have to fix it.
Eight articles on the controls this product measures and the method behind it. Each one is written for a specific question, links to the authoritative standard, and avoids restating the same introduction in different words.
Guides
How the controls work in practice.
Fundamentals, email authentication, DNS, infrastructure and web configuration — each explained from first principles rather than from a vendor checklist.
External security posture assessment: what it measures and what it cannot
A working definition of external posture assessment, the controls it can observe without authentication, and the conclusions it is not entitled to draw.
FundamentalsSMB cybersecurity: where small businesses are actually exposed
Most small-business incidents start with something visible from the public internet. A practical look at the five exposures that appear again and again.
Email authenticationSPF, DKIM and DMARC: how email authentication actually works
The three records that decide whether a stranger can send mail as your domain, how they interact, and the order to fix them in.
DNS and transportDNSSEC in plain terms: what it protects and what it does not
DNSSEC makes forged DNS answers detectable. It does not make anything private. Here is the chain of trust, the common misconfigurations, and the failure modes.
Web and infrastructureMapping public-facing infrastructure without overstepping
How to build an inventory of what your organisation exposes, what passive sources exist, and where authorisation stops being optional.
Web and infrastructureSix security misconfigurations that are visible from outside
Open admin interfaces, dangling DNS records, missing HSTS, verbose banners and three more patterns that external assessment reliably catches.
Method
How measurement and reporting should work.
What a defensible assessment looks like, and how to read the number it produces.
How to read a 0-100 security posture score honestly
Why a single number is useful for prioritisation and dangerous as a certificate, and the questions to ask before you quote one in a board pack.
Method and measurementExternal assessment methodology: scope, evidence and limits
A defensible assessment method: define scope, pick a vantage point, attach evidence, separate absence of evidence from evidence of absence, and write down the limits.
Editorial standard
What this section will not do.
A knowledge base is only useful if it says something. These are the rules the articles follow.
- No keyword fillerEvery article answers a question someone would actually ask, and links to the RFC or vendor documentation rather than paraphrasing it loosely.
- No invented authorityNo fabricated citations, no made-up statistics, no claims of testing that did not happen.
- No disguised product pitchArticles explain the topic first. Where the product is relevant, the link is explicit.
- Corrections welcomeIf something here is wrong or out of date, the contact form reaches the maintainer directly.
Where to start
If you are new to this: begin with the external posture assessment definition, then read the SMB exposure survey.
If you are fixing email: go straight to SPF, DKIM and DMARC — it is the highest-value gap in most small businesses.
If you are evaluating the product: read the posture score article, then compare it with the methodology.
Blog
Prefer a sequence to follow?
The knowledge base explains how a control works. The blog covers what to do about it: a rollout order for DMARC, a fifteen-check website routine, and a walkthrough of an assessment report.
SPF, DKIM and DMARC, explained without the acronym soup
What the three email records actually do, how they work together, and a ten-minute check you can run on your own domain without changing anything.
Email securityHow to roll out DMARC without breaking your email
A staged rollout that starts in monitoring mode, uses aggregate reports to find every sender you forgot about, and only then moves to enforcement.
Email securityWhy your business email keeps landing in spam
Authentication failures, mismatched sending domains, new-domain reputation and list breakage all look the same from the inbox. Here is how to tell them apart.
Want to see the method applied to a real domain?
The recorded assessment shows every finding with its evidence, score and timestamp.