Posture findings
Configuration and control issues from Microsoft assessments and external checks.
Severity, evidence and recommendations, with rescans and history for follow-up.
One workspace.
Every customer
in context.
Manage Microsoft 365 posture, external assets and customer reviews together. Add operational security signals when your MSP needs them.
Cedarbridge Group
3 assets · Microsoft 365 connected · last scan 18 Jun 2026, 09:15
Biggest risk: No DMARC policy in cedarbridge.example.
Microsoft 365
862 high · 3 medium · 2 low
External attack surface
712 high · 2 medium · 1 low
No changes since the last scan.
Fix these first
No DMARC policycedarbridge.example
HighNo DMARC policycedarbridge-services.example
HighMicrosoft Secure Score is lowcedarbridge-demo · Microsoft 365
HighSecurity defaults are off (and no replacement)cedarbridge-demo · Microsoft 365
HighMicrosoft 365 DKIM is not enabledcedarbridge-services.example
MediumNeeds setup
Subdomain discovery: limited visibility. A lookup source was unavailable during the last run. 6 of 10 demo hosts checked.
Assets
| Asset | Score | Findings | Monitoring |
|---|---|---|---|
cedarbridge-demoMicrosoft 365 tenant | 86 | 7 | Daily |
cedarbridge.exampleDomain · email & DNS | 74 | 2 | Weekly |
cedarbridge-services.exampleDomain · email & DNS | 68 | 3 | Weekly |
Customer context.
Not another silo.
Every managed customer has a dedicated workspace for tenants, domains, websites, findings, scan history and reports, scoped to your MSP organisation.
Explore MSP workflows- From your portfolio to a single asset.
- Work across customers, then focus on the Microsoft tenant, domain or website behind a finding.
- History that stays with the customer.
- Review previous scans and prepare reports from the same customer context.
- Access that follows your team.
- Owner, admin, analyst, technician and viewer roles, with filters and saved views for day-to-day work.
From identity
to attack surface.
Microsoft 365 & Entra
Read-only assessments of connected tenants, with the permissions and licensing context kept visible.
- Identity & access
- MFA and privileged-role signals, Conditional Access and security defaults.
- Tenant context
- Guest access, Microsoft licensing and available assessment signals.
- Secure Score & sync health
- Track Microsoft Secure Score alongside assessment findings and source health.
Identity & configuration
Havenwood Manufacturing · havenwood.example
Administrator MFANeeds review
Conditional AccessPolicy found
Security defaultsAssessed
Guest accessReview recommended
Graph syncUp to date
Microsoft Graph accessRead only
External attack surface
See what is externally observable on approved customer domains and websites, without exploit execution.
- Discovery & exposed services
- Passive subdomain discovery through DNS and Certificate Transparency; connect-only checks for risky open ports.
- Subdomain takeover
- Identify dangling DNS records that may leave a subdomain exposed.
- Web-app exposure
- Check for exposed .git and .env files, backups, debug endpoints, directory listings and admin panels.
External assets
Larchstone Logistics · larchstone.example
Subdomain discoveryCompleted
Dangling DNS recordNeeds review
Internet-exposed serviceDetected
Web-app exposureAssessed
High
Dangling DNS recordlegacy.larchstone.example
Email & domain security
Assess DNS-observable email authentication and domain hygiene beyond a simple SPF check.
- Sender authentication
- SPF hardening, graded DMARC, DKIM key inspection and BIMI.
- Mail transport
- MTA-STS, DANE, TLS-RPT, Null MX and MX resolvability.
- DNS configuration
- DNS, DNSSEC, MX and CAA record checks for registered domain assets.
Email authentication
Havenwood Manufacturing · havenwood.example
SPFPresent
DMARCReview policy
DKIM key inspectionAssessed
MTA-STS policyMissing
DNSSEC & CAAAssessed
Assessment sourceRegistered domain
Web & TLS posture
Review the website and transport controls visible from outside the customer environment.
- HTTPS & certificates
- TLS configuration, certificate validity and expiry.
- Browser protections
- HSTS, Content-Security-Policy and other security headers, cookies and CORS.
- Website context
- security.txt and technology fingerprints that support further exposure review.
Website assessment
Briarfield Group · briarfield.example
HTTPS & TLSAssessed
Certificate validityValid
Content-Security-PolicyMissing
HSTSPresent
Cookies & CORSAssessed
Latest complete assessment1 June 2026
Know what changed.
Keep reviews current.
Scheduled assessments, scan history and source health help your team follow changes between customer reviews.
- Schedules, change detection & alerts
- Monitor tenant and asset posture on a configured schedule. Route notifications by severity and event type to the right recipients.
- Certificates & weekly risk digests
- Track certificate expiry and receive a per-customer risk digest. CISA KEV exposure alerts flag relevant newly listed vulnerabilities.
- Trends & forecasts
- Use assessment history, drift awareness and the posture-score forecast to support follow-up.
Monitoring activity
Demo dataHavenwood Manufacturinghavenwood.example
Website assessment completed
Latest assessment available for review.
Certificate expiry approaching
portal.havenwood.example expires in 22 days.
Weekly risk digest ready
Customer risk summary prepared for review.
Scheduled website scan2 June · 09:30
Security posture reviews.
Ready for the conversation.
Customer-ready reports that connect the security score, priority risks and recommended actions. Executive context and technical evidence in the same review.
- Priorities with clear next steps.
- See the highest risks, recommended actions, severity and suggested timing.
- Evidence behind each finding.
- What we found, why it matters and what to do, with affected assets and assessment scope.
- The score in context.
- The same security score as the dashboard, with a 90-day trend. Incomplete assessments do not create a false-safe result.
Security posture report
Briarfield Group3 March 2026 - 1 June 2026
Monitored assets show gaps in services exposed to the internet and website security settings.
2 open findings · 1 asset monitored
Microsoft 365 not assessed.
Top 2 risks
High-risk service exposedremote.briarfield.example
CriticalContent-Security-Policy header missingbriarfield.example
MediumScore trend, last 90 days
One platform.
Distinct security workflows.
Posture findings remain in the assessment workflow. Security Operations, included for MSP organizations, brings operational alerts and vulnerability tasks into separate workflows, not a merged risk feed. Microsoft Defender and Entra signals need the customer’s licences and consent.
Operational alerts
Microsoft Defender incidents and alerts, plus Entra risky-user and sign-in signals.
Acknowledge, assign, add notes, escalate and manage SLA follow-up. Availability depends on connected sources.
Critical CVE exposure
Detected technologies matched against NVD, CISA KEV and EPSS intelligence.
A separate exposure lifecycle with confidence, freshness and safe rescans. A match is not proof of exploitation.
Certificates & customer updates
A dedicated Certificates tab shows Certificate Transparency observations and upcoming expiry. Outbound updates support customer communication, without a customer portal.
Clear boundaries.
Visible data quality.
Missing or outdated source data should stay visible, not look like a clean security result.
- Read-only Microsoft access
- Assess with read permissions. No write-back or automatic remediation.
- Approved assets only
- Non-invasive external checks, SSRF protections and connect-only port probes. No exploit execution.
- Your team stays in control
- Organisation roles govern access. Your team reviews the evidence and implements changes.
Understand the state of each source.
- Never synced
- An initial successful sync has not completed.
- Delayed or degraded
- A source is behind its expected interval or returning incomplete data.
- Permission or licence gaps
- Required Microsoft access or licensing is unavailable.
- Stale evidence
- A fingerprint or assessment needs refreshing before exposure context can be trusted.
Before you connect.
Discuss your deploymentIs SecurityScore a SIEM, MDR or XDR service?
No. SecurityScore manages posture and includes an MSP-only Security Operations workspace. It is not a SIEM, MDR, XDR or ticketing platform.
Does an assessment make changes to a tenant?
No. Microsoft assessments use read-only access. Findings provide evidence and recommendations; your team decides and implements the changes. There is no automated remediation.
What happens when an assessment is incomplete?
The score uses the latest complete assessment for each monitored asset. An incomplete scan does not replace it. Assets without a complete assessment are shown as limited visibility and left out of the score. The score is a directional indicator, not a compliance certification.
Are reports fully white-labelled?
Reports are customer-ready and printable. Report PDFs and report emails can carry your brand name, your uploaded logo, one accent colour, footer text, your contact details and a disclaimer, and can hide the SecurityScore.me name. The dashboard itself is not rebranded, and there is no custom domain. The sample on this page uses fictional data.
Is monitoring immediate or guaranteed in real time?
Monitoring uses configured schedules and available source data. Source-health states show delays, degraded syncs and permission or licence gaps. The platform does not promise immediate detection.