Guides

What to fix first

You have a list. This is how to turn it into an order.

Start with the Action plan

Security posture, Action plan sorts issues by the points each one costs, not by severity. A "critical" on one host nobody can reach may cost less than a "medium" that repeats on sixty hosts and closes with one configuration change.

Severity tells you how bad a thing is if exploited. It does not tell you how much of your estate you can clear in an hour.

  1. Open Action plan, or select Fix top issue on Overview.
  2. Work from the top. Points are the shortest route to a better grade.
  3. After a fix, wait for the next run (or use Rate now on the domain). Then open History and look for the issue under Fixed issues.

Note: Recompute now does not prove a fix. Only a new run that no longer sees the issue does.

Then the things that are actually exposed

Once the broad wins are done, look at what is reachable and yours:

  1. Exposed: reachable from the internet right now.
  2. Controls missing: a protection that should be present and is not.
  3. Recorded facts: inventory, not problems. These need to be correct, not fixed. Confirm they are yours and move on.

A large part of a first scan is Hunto telling you what exists, not what is wrong. Treating inventory as a backlog is the fastest way to feel defeated by a healthy result.

Things to deprioritise honestly

  • Anything you do not own. Mark it as not yours rather than not a risk, so the scope improves instead of the judgement.
  • Registered-but-unused lookalike domains. Watch them. Chasing every speculative registration is a full-time job with no security outcome.
  • Findings on systems already scheduled for decommission. Note the date and move on.

Reconciling with your own risk process

Hunto orders by points. Your organisation may weigh a specific system far more heavily than Hunto can know: a payment path, a regulated database, a customer-facing login.

Set that asset's criticality to high in All Assets. Your Security score then counts its issues at 1.5 times their weight, and they rise in the Action plan. Your Standard rating does not use criticality, so it stays comparable with other organisations.

When the score moves the wrong way

A grade that gets worse after you have fixed things is usually coverage improving: a check that could not run before now can, and it found something real that was always there. Open History and read New issues under the rating before you report it to anyone.

See Nothing found is not the same as we could not look and History and rating changes.

Next