External security posture assessment: what it measures and what it cannot

A working definition

External security posture assessment is the practice of describing an organisation's security configuration and exposure using only what can be observed from the public internet, without credentials and without privileged access.

The word posture is doing real work here. It describes a configuration state, not an attack outcome. A posture assessment can tell you that a domain publishes no DMARC policy. It cannot tell you that someone is currently spoofing that domain, or that anyone ever has.

That distinction matters commercially as well as technically. Posture findings are usually cheap to fix and easy to verify, which makes them a sensible first pass before anyone commissions deeper work.

What is actually observable

Almost everything an external assessment reads is published deliberately. DNS answers exist so that the internet can find you. SPF and DMARC records exist so that receivers can decide whether to trust a message. TLS certificates exist so that a browser can verify an identity. HTTP headers exist so that a browser knows how to behave.

The assessment reads those artefacts and compares them with published expectations: RFC 7208 for SPF, RFC 7489 for DMARC, RFC 4034 for DNSSEC, the relevant TLS guidance for protocol and certificate configuration, and vendor documentation for header behaviour.

Five observation types cover the catalog used by this project: DNS queries, mail authentication policy records, TLS handshakes, HTTP response headers, and protocol-level reachability of specific ports. Read the 22-control catalog for the specific checks.

What it is not entitled to conclude

An external assessment cannot establish that a system is secure, that a weakness is exploitable, or that a compromise has occurred. Each of those requires either access the assessment does not have, or actions it deliberately does not take.

This is not a limitation to be buried in a footnote. It changes how a report should be read. A failed DMARC check is a fact about a DNS record. Whether that fact was exploited is a separate question with a separate evidence requirement.

Similarly, a passing control is not a control that cannot be bypassed. It is a control that was configured as expected at the moment it was observed.

Why evidence changes the conversation

A finding that quotes its observation can be checked by someone who was not there. That is the difference between a report that starts an argument about trust and a report that starts a work item.

In practice this looks unremarkable: a DMARC record, an SPF policy, a certificate subject, a header line. Unremarkable is the point. Anyone with a terminal can reproduce the query and compare the answer. If they differ, the finding is stale or vantage-specific — and saying so openly is more useful than defending a number.

SMB Scanner Lite applies this as a rule it calls no claim without evidence, including a separate status for a check that returned no conclusive answer. See the methodology for how that is implemented.

Who should care, and when

Small and medium businesses are the clearest beneficiaries. They are visible enough to be impersonated by email, frequently run remote-access services that were intended to be internal, and rarely have anyone whose job is to look at the public footprint monthly.

Consultants and managed service providers use external posture assessment as a defensible starting point: it produces a short list of verifiable observations before a deeper engagement is scoped or sold.

The practical trigger points are familiar: a new customer questionnaire, a cyber-insurance renewal, an acquisition due-diligence request, a suspicious invoice email, or simply a change of hosting provider.

The honest boundary

Everything an external assessment produces is partial. It depends on a vantage point, a resolver and a moment in time. It cannot see behind authentication. It says nothing about people, process or physical security.

The correct posture towards that boundary is to state it in the same document that delivers the findings. Read the full list on the assessment limitations page, or inspect a real report in the recorded assessment.