External assessments
What an external assessment checks, the difference between passive and active mode, and how to read the results.
Updated
On this page
An external assessment looks at a customer's public-facing posture the way an outsider would: their domains, email, websites and anything reachable from the internet. Results feed the customer's findings, score, Attack surface and reports.
Run one
In the customer's workspace open Assessments → New assessment (also on Home), choose External, tick the domains to include and pick a mode. Results stream in as checks finish.
Automatic assessments
You don't need to start assessments for your managed customers. RevoSecure runs them on its own:
| First run | Then | |
|---|---|---|
| External (passive, every domain of the customer) | Within the hour after the customer's first domain is added | Weekly |
| Microsoft 365 | Right after the customer's tenant is connected | Weekly |
The customer's Assessments page shows whether they run, what each is doing and when the next one is due (for example Next run Tue 4 Nov, 05:11). Automatic runs are always passive and appear in the list like any other, named External assessment (automatic) and Microsoft 365 assessment (automatic).
- Not for prospects (run their assessments yourself), archived customers or demo tenants.
- Your schedule wins. A customer with its own schedule for a kind gets that schedule instead.
- After a failure it waits a day before trying again; the Assessments page says when.
- Plan limits. On plans with a monthly assessment limit, automatic runs stop at 80% of it so you can always run your own.
- Notifications work as for scheduled runs: only people who turned on assessment notifications hear about them.
- Turn it off for the whole workspace in Settings → Workspace → Automatic assessments, or for one customer with Run automatically on its Assessments page (also in Customer settings → Profile).
What it checks
| Area | Checks |
|---|---|
| DNS | DNSSEC, name server setup, zone transfer (active mode only) |
| SPF, DKIM, DMARC, MTA-STS and TLS-RPT | |
| TLS | Certificates, protocol versions and ciphers, including probes for legacy protocols |
| Websites | Security headers (HSTS, CSP and others), disclosed software versions |
| Attack surface | Subdomains from certificate transparency and public archives, subdomain takeover, exposed services |
| Vulnerabilities | Software versions websites disclose, matched to known CVEs with CISA KEV and EPSS |
| Domain | Registration and expiry, lookalike domains |
| Reputation | Whether security-filtering DNS services block the domain, www, its mail servers and other discovered hosts |
| Dark web | Every external assessment includes the dark web and exposure checks |
Network ownership shows which provider (hosting company, cloud platform, CDN) announces each address. It's context for reading the other results, never a finding.
Passive and active
| Passive | Active | |
|---|---|---|
| Uses | Public data and standard client connections (DNS queries, an HTTPS request, a TLS handshake) | Adds port scanning and zone-transfer tests |
| Safe for prospects | Yes | No |
| Needs | Nothing | A verified domain, a written authorization attestation, and administrator approval |
| Scheduled | Yes | Run by hand |
Requests for an active scan from someone without approval permission wait as pending approval until an administrator approves them. See Scope, domain verification and authorization.
Reading the results
- Findings carry severity, confidence, evidence, impact and remediation steps. Version banners give suspected findings at most.
- Blocked by protective DNS means a security-filtering resolver refuses a name that resolves normally elsewhere: people behind it can't reach the site, and the provider's threat intelligence links it to malware, phishing or compromise. Treat it as a possible compromise: check the site and DNS for unauthorised content, clean up, then ask the provider to review the listing (links are in the finding).
- Coverage. A check that timed out or errored is shown as not checked, never as passed, and reports carry a coverage notice listing them. If an optional source for subdomain discovery is unavailable, a "no sensitive hostnames" result is withheld rather than reported as a pass.
What happens to findings over time
Findings are de-duplicated across runs. A later run where the covering check passes resolves them; a regression reopens them. An errored check resolves nothing. See Triage workflow and keep the customer monitored with a schedule: Scheduled assessments and monitoring.
The Attack surface page
The customer's Attack surface collects what external assessments found: Domains & websites, Hosts & services, Mail servers and open external findings, each opening in a quick look. Set an asset's criticality on its page to raise the risk score of its findings.