Report types
- Executive summary: the big picture, with remediation progress and your top open risks.
- Technical vulnerability: the detail, for the people who fix things.
- Asset security: one asset in depth (you choose the asset).
Options include the period in days, a minimum severity and whether to include resolved findings. An organization can generate up to 5 reports per hour. Download through a short-lived signed link. Reports expire after the retention period shown on the report.
What every report contains
- Scope and authorization: every asset with its type and verification method and date, and the authorization records behind active scans. Unverified assets are labelled NOT VERIFIED.
- Scan profile and modules executed: the modules the latest scan really ran, each with its outcome and limits. A module that timed out, was blocked, skipped or failed authentication is shown as inconclusive, never as passed.
- Coverage limitations: no findings does not mean comprehensive coverage; an automated scan is not a penetration test or certification.
- TLS, DNS and security-header snapshots, with certificate expiry as an exact UTC time.
- Comparison with the previous scan: new, resolved, reopened, severity changed and still open, plus the score change.
- Methodology: scanner version, score methodology and weights, and the scanner source addresses to allow-list.
All times are UTC. When more findings match than the report limit allows, a banner states "showing N of M findings", most severe first. False positives are never listed.
Branding (Business plan and above)
Under Settings → Branding, owners and admins can set a company name, address, footer text, an accent color (a dark #RRGGBB color that stays readable with white text) and a logo (PNG or JPEG, up to 512 KB and 1024 × 1024 pixels; the image is re-encoded and its metadata removed). Use Preview to see the cover page, then tick Apply my company branding when you generate a report. On other plans the option is shown disabled with an upgrade note.