Explore this guidance in context: Website security · Vulnerability management. Each topic includes an overview, related guides and a working template.

In this article

01Start with the question you need answered

A public baseline check is useful for questions such as whether a domain publishes an email policy or whether a web response contains a particular security header. It examines a limited set of publicly accessible signals. It does not sign in to your application, inspect your source code or establish that the whole organisation is secure.

In CyberScan’s no-key mode, no third-party scanner API key is required. Verify control of a domain you own or are authorised to assess before running a live check. The check uses public DNS and ordinary web requests where available. A request may still appear in the target’s access logs. Read the report’s coverage and unavailable checks.

02What an API connection changes

A connected provider can expose the scanner capabilities available under your provider account, plan and selected job. Those capabilities vary. An API key authenticates CyberScan to that provider; it does not automatically authenticate a scan inside your website. Application login, target verification and more intrusive checks require their own supported configuration and authorisation.

Review the provider, target, selected scan and any costs or account limits before starting work. A connection error, quota limit or incomplete job must remain an incomplete result. It cannot support a clean bill of health.

03Match the report to its scope

  1. Check the domain, time, scan mode and tests actually completed.
  2. Separate observed facts from inferred risks and checks that could not run.
  3. Ask for application testing when the question concerns access control, business logic or data visible only after login.
  4. Use a qualified, explicitly scoped penetration test when you need deeper manual investigation or independent assurance.

04Use the result as the next action

A useful report helps you decide what to verify, who should fix it and how to retest. A score is a summary of the chosen checks at one time. Keep its coverage beside it whenever you share the result with a customer, provider or insurer.

Sources & further reading

NCSC: Penetration testing (opens in a new tab)

Use the linked primary sources for current technical details. Guidance reflects the scope and dates described in this article.

TURN READING INTO ACTION

Put the guidance to work.

Choose a check with the right scope, inspect its observations and follow up with the person who can make the change.

Choose a security check More practical resources