"Nothing found" is not the same as "we couldn't look"
A clean result can mean two very different things:
- We looked, and there is nothing there. Good news.
- We could not look. No news at all, which can look like good news.
They can appear similar on a page, and the second one is risky precisely because it is reassuring. This page shows how to tell them apart.
What Hunto does about it
Hunto scores only what it measured.
| You see | It means |
|---|---|
| A section with a score | One of its checks ran and worked in the run that rates the domain |
| Not measured | No check for the section has run, or its check failed in the latest run. The section is left out of the grade. It is not counted as perfect and not held against you |
| Provisional on the grade | Less than 60% of the score's weight was measured. Do not present it as final |
| Not in your plan | The module is not part of your plan. The section is not part of your score |
| "Checked with nothing found" in a report | The category was checked and no issue was found. It lists what was checked, not a promise that nothing exists |
Open Security posture, Rating and read each section's state and the reason under it before you trust a good grade.
Note: a check that finishes normally but has nothing to report counts as measured with no issues. Some checks depend on outside sources, and an outage of a source is not always visible to the check. That is why the questions below still matter.
Before you trust a quiet result
- Did the check run? A section that never ran is not the same as one that ran and found nothing. Look at the run behind the rating: its date, and how many checks ran, failed or did not run.
- Is it plausible? Zero exposed code for a company with a large engineering team, or zero lookalikes for a well-known consumer brand, deserves a second look. Real zeroes happen, but they are rarer than they appear.
- Did it change suddenly? A surface that had issues last week and none this week, with no fix in between, is far more likely to be a coverage problem than a clean-up. Open History and read the rating's Fixed issues.
Checks that depend on outside sources
These are the ones where "quiet" most often means "unavailable" rather than "clean":
- Leaked credentials and breach data
- Lookalike and impersonating domains
- Exposed code and secrets in public repositories
- Social and app-store impersonation
Checks of your own infrastructure (DNS, mail posture, certificates, hosts) are observed directly and do not have this problem in the same way.
If a grade got worse after a broader check
That is usually coverage improving, not posture getting worse: a check that could not run before now can, and it found something that was there all along. History shows the new issues under the rating.
If you suspect a gap
Tell us which section and when. We can see whether a source failed for your organisation. That is a quicker answer than running scans again and hoping the number changes.