Complex IT.
One clear view
of risk.

Bring Microsoft 365, your external attack surface and security findings into one view. Give IT and leadership the context to act.

SecurityScore.me
Example AdvisoryDemo data

Today

5 customers
Critical & high8across 3 customers
Limited visibility1Cedar Retail
Resolved, 30 days23across 4 customers
Reports not sent2across 2 customers

Top findings

High-risk service exposedremote.briarfield.example · CriticalFinding
High-risk service exposeddb.westhaven.example · CriticalFinding
Administrator MFA coverageaster.example · HighFinding
Email authentication policywesthaven.example · HighFinding
Content-Security-Policy header missingbriarfield.example · MediumFinding

Findings by severity

Critical
2
High
6
Medium
6
Low
10

Customers

Fictional customer scores and open findings. Cedar Retail has no complete assessment.
CustomerScoreOpen
Briarfield Group722
Westhaven Logistics669
Aster Manufacturing849
Cedar Retail-0
Lumen Works914

Know which risks
need attention.

Your IT environment extends beyond a single tenant or domain. Your visibility should too. Bring findings together and see where attention is needed.

How SecurityScore works

Visibility across your environments.

View connected tenants, domains and websites in the same context.

Priorities backed by evidence.

Move from a list of findings to a focused assessment. Review severity, evidence and recommendations together.

Better-informed security reviews.

Share the security picture through reports for client reviews, leadership and the teams responsible for improvements.

From identity
to attack surface.

A client-ready report with the security score, the highest risks and what to do first.

Priorities with clear next steps.

See the top risks and recommended actions, with severity and suggested timing.

The evidence behind each finding.

Grouped issues explain what was found, why it matters and what to do. The asset inventory includes scores and scan dates.

The score in context.

The same score as the dashboard, a 90-day trend and a clear distinction between assessed and unassessed areas.

Download PDF
SecurityScore.meDemo report · Fictional data

Security posture report

Briarfield Group3 March 2026 - 1 June 2026

72 FAIR
Monitored assets show gaps in services exposed to the internet and website security settings.

2 open findings · 1 asset monitored

Microsoft 365 not assessed.

Top 2 risks

High-risk service exposedremote.briarfield.example
Critical
Content-Security-Policy header missingbriarfield.example
Medium

Score trend, last 90 days

0204060801006472 3 March 20261 June 2026

Technical detail.
Business context.

Less searching.
More focused assessment.

Review configuration issues and externally visible risks in context. Use the evidence and recommendations to decide your next step.

Findings in contextConnect severity and evidence to the right managed environment.
Changes over timeCompare assessments and track changes across reviews.
Source quality stays visibleIdentify missing permissions, outdated data and synchronisation issues.

From first insight
to focused action.

Connect.

Connect Microsoft tenants and register the domains and websites you are authorised to assess.

Assess.

Run assessments and review findings, evidence and the quality of your sources.

Prioritise.

Review severity and recommendations. Agree with your team on which improvements come first.

Follow through.

Track changes and use reports in recurring client and management reviews.

Your environment.
Your control.

A clear view of risk also needs clear boundaries. SecurityScore assesses and reports; your team remains responsible for follow-up.

Explore the platform architecture

Read-only access

Microsoft assessments use read permissions. No write-back or automatic remediation.

Role-based permissions

Organisation roles determine who manages clients, runs scans and views reports.

No endpoint agent

Cloud-based assessments, without installing software on client workstations.

Visibility into data quality

Delayed or incomplete sources are shown as limited visibility, not as a secure result.

Turn security data
into informed decisions.

Book your platform demo

Sample security posture report

PDF
SecurityScore.meDemo report · Fictional data

Security posture report

Briarfield Group

Prepared by Example Advisory · 3 March 2026 to 1 June 2026
Generated 1 June 2026 at 09:30

72 FAIR

Security score, the same as on the dashboard

Monitored assets show gaps in services exposed to the internet and website security settings.

No domain is monitored. Email authentication was checked only through the website scan (SPF and DMARC); DKIM, MTA-STS and the other mail checks were not run.

Score increased from 64 to 72 over this report period.

2 open findings: 1 critical and 1 medium. 1 asset monitored, last scan 1 June 2026.

Top 2 risks

High-risk service exposed

Critical

remote.briarfield.example

A remote desktop service reachable from the internet provides a possible entry point into the network.

Content-Security-Policy header missing

Medium

briarfield.example

A Content-Security-Policy limits the impact of a script injection flaw. This protection is missing from the assessed website.

Example Advisory · Briarfield Group1 / 5
SecurityScore.meDemo report · Fictional data

What to do first

Restrict Remote Desktop (3389) to approved access paths and networks.

Critical

High-risk service exposed · remote.briarfield.example · Immediate

Publish a Content-Security-Policy that matches the application dependencies. Check legitimate third-party assets before enforcement.

Medium

Content-Security-Policy header missing · briarfield.example · Within 30 days

Score trend, last 90 days

0204060801006472 3 March 20261 June 2026

First point 64 on 3 March 2026, last point 72 on 1 June 2026.

Example Advisory · Briarfield Group2 / 5
SecurityScore.meDemo report · Fictional data

Findings by area

2 open findings, grouped into 2 issues: the same issue on several assets is listed once.

Findings by area in the fictional customer assessment
AreaScoreAssessmentOpen findings
Website72Assessed1
Microsoft 365Not assessedNot assessed0
DNSIn Website scoreCovered by Website scan0
TLSIn Website scoreCovered by Website scan0
HTTP headersIn Website scoreCovered by Website scan1
IdentityNot assessedNot assessed0
Email securityIn Website scoreCovered by Website scan0
CookiesIn Website scoreCovered by Website scan0
CORSIn Website scoreCovered by Website scan0

Website 1 issue

Content-Security-Policy header missing

Medium

briarfield.example · Open since 22 May 2026

What we found

No Content-Security-Policy is enforced on this fictional website, reducing protection against content injection.

Why it matters

A Content-Security-Policy limits the impact of a script injection flaw. This protection is missing from the assessed website.

What to do

Publish a Content-Security-Policy that matches the application dependencies. Check legitimate third-party assets before enforcement.

Example Advisory · Briarfield Group3 / 5
SecurityScore.meDemo report · Fictional data

Exposed services and hosts 1 issue

High-risk service exposed

Critical

remote.briarfield.example · Open since 18 May 2026

What we found

The fictional host remote.briarfield.example exposes Remote Desktop (3389) to the internet.

Why it matters

A remote desktop service reachable from the internet provides a possible entry point into the network.

What to do

Restrict Remote Desktop (3389) to approved access paths and networks.

Assets

Monitored fictional assets
AssetTypeScoreLast scan
briarfield.exampleWebsite721 June 2026
Example Advisory · Briarfield Group4 / 5
SecurityScore.meDemo report · Fictional data

Appendix

How the score is calculated

The security score is the average of the latest complete assessment of each monitored asset, the same score as on the dashboard. An assessment that could not run every check (scan warnings, missing Microsoft 365 permissions) never counts: the asset's last complete assessment counts instead, and an asset without one is left out as limited visibility.

Score bands: Good from 80, Fair from 60, Poor from 40, Critical below 40. This is a directional indicator, not a compliance certification.

Scope and disclaimer

Assessed: external website and domain posture where registered, Microsoft 365 where connected, and the scheduled and manual scans of the report period. This report is informational and reflects point-in-time posture scans. It does not guarantee compliance with any framework or eliminate all security risk. This is not a penetration test and not a compliance certification.

Findings reflect externally observable posture and connected Microsoft 365 signals available to SecurityScore.me at generation time.

About this demonstration

All organisations, domains, scores, dates, assets and findings in this example are fictional. No customer environment was accessed or assessed to produce it.

Example Advisory · Briarfield Group5 / 5