Scores in Reports and PDFs
You can take a rating out of Hunto as a PDF: the Digital risk & exposure assessment. It is built from finished discovery runs of one domain, and it puts the grade, the rating areas and the findings in a form you can send to a board, an auditor or a customer.
Make a report from a run
- Open a finished run of a domain (from Discoveries, or from a domain on Security posture).
- Select Report (PDF) in the page header. The button is disabled while the run is still going: "The report can be made once this run has finished."
- In the Create report pane, check the runs it covers. You can add other recent runs of the same domain or remove some (a report covers one domain and shows "N of at most M" runs).
- Set the Title, the Audience (Customer shows hosts and addresses in full) and Prepared for.
- Select Create to preview.
- Select Generate report to store it, then Download PDF. Print and Open report are there if you would rather save the PDF from your browser (A4, no margins, background graphics on).
You can also start from Reports and pick a domain, then its finished runs from the last 90 days.
Note: if the PDF cannot be made, the pane says "The PDF could not be made" and keeps a report record. Select Download PDF again to retry.
What the report says about your score
| Section | Content |
|---|---|
| At a glance | The grade, assets discovered and findings |
| Executive summary | A short summary and the top three priorities |
| Rating areas | The score of each rating area, the same sections as on Security posture |
| Where the risk is | Every category of the twelve, ordered by risk |
| Category pages | For each category with findings: what was found, and a findings table |
| Evidence | Two evidence cards |
| What changed | The change since the previous comparable assessment |
| Checked with nothing found | Categories checked with nothing found, and those not covered |
| About this report | How the report was made, and severity |
The report is built from the ratings of the runs you chose. Its grade uses the same bands and methodology as Security posture.
Note: "Checked with nothing found" is not a promise that nothing exists. It lists what was checked. See Nothing found is not the same as we could not look.
Your organisation's score outside a report
There is no organisation-wide score report in the assessment. To put your security score, its history or its top issues into your own documents, read them through the API or MCP. See Scoring through the API and MCP.
Before you send a report
- Confirm the grade is not provisional. A provisional grade says so on the badge, and the report should not be described as final.
- Check the run date. A report describes the run, not today.
- Choose the audience deliberately. Customer reports show hosts and addresses in full.
- Remember that the standard rating ignores your accepted risks. If you send it to a customer, it will not reflect internal decisions.
Use cases and wiring tips
- Board report trend: attach the report of your latest run to the quarterly pack, and copy the trend from the History tab. Use the same domain each quarter for comparison.
- Show a fix: generate a report after a remediation run. The What changed section shows the improvement.
- Customer questionnaire: send the PDF with your standard rating, and offer the shared outside-in view for verification. See Sharing, vendor view and domain verification.
- Schedule regular runs with Repeat on the run page so that every report has a recent run behind it.