Reading your first results
Your first scan has produced a lot. This page is about making it mean something before you start fixing anything.
Three words that are not the same thing
Most early confusion is vocabulary. These are distinct on purpose:
| Word | What it is | Who decided |
|---|---|---|
| Asset | Something you own and want watched — a domain, a brand, an IP range | You |
| Finding | Something a check observed. Raw. May be wrong. | A scan |
| Detection | A finding that has been judged real and worth your attention | Our triage, or you |
Findings greatly outnumber detections, and that ratio is the system working. A first scan of a real estate commonly produces several hundred findings and a much smaller number of detections.
Why there is noise, and why that is not a defect
A check that only ever reported things it was certain about would miss most of what matters. So checks are deliberately generous, and a second stage decides what is real. You are looking at the output of both stages, and you can see the in-between state.
The honest framing: early noise is the cost of not missing things. It falls sharply after the first pass, as classification learns your estate. If it does not fall, tell us — that is a real problem and we want it.
The lifecycle in full: Detection to Resolution.
Read it in this order
- Inventory first, not findings. Before judging any result, look at what we think you own. If something there is not yours, everything downstream of it is noise — fix the scope and the list improves at once.
- Then Exposures. Ranked by how many hosts one fix closes. The top row is usually a single change that clears many rows.
- Then the score. Last, not first — a score with no context is a number to argue about. Once you have seen the inventory and the exposures, it means something.
"This isn't ours"
You will find things that are not yours — a lookalike domain that is genuinely somebody else's business, a host that left your estate years ago. Dismiss them, but dismiss them as that: the reason you give is what stops the same class coming back. Dismissing as "not a risk" when you mean "not ours" teaches the system the wrong lesson.
What good looks like after a week
- Inventory matches what you believe you own, plus a handful of genuine surprises.
- Exposures has a short top section you are actually working through.
- New findings arrive at a trickle, not a flood.
If you are still drowning after a week, something is scoped wrong. That is worth a conversation, not more triage.