The dashboard: posture, actions and what is coming due

The first page of the app, Domains, opens on a dashboard of your proved domains, above the list of all your domains. It appears once at least one proved domain has had its first full audit; quick checks run before the proof are left out of it.

Posture of your domains

The gauge shows the average score of your proved domains, with its grade. Next to it:

• how the average moved over the last 30 days (it shows once your domains have 30 days of audits; domains audited only since then are left out of the comparison);
• what the average would be if you do the first three actions of the list below, when that would raise it.

Open findings, surface and e-mail protection

• Open findings: how many critical, high, medium and low findings are open across your proved domains, with a bar in their colours. Accepted findings and info findings are not counted.
• Surface: how many hosts and IP addresses the latest audits saw, counted as on the Inventory page.
• E-mail protection: how many of your proved domains publish a DMARC policy at p=reject, and how many at p=quarantine. The goal is all of them at reject: see DMARC step by step.

Do these first

The list ranks the fixes across all your proved domains by the points they would bring back to a domain’s score, worked out with the score formula. A finding found on several hosts takes one line (“on 4 hosts”), because fixing that kind of finding on every host is what brings the points back. Each line links to the finding on its domain’s page, where you find the fix.

When nothing is left to fix on your proved domains, the list says so.

Each domain’s own page has its own Do these first card: the three findings that matter most for that domain, the quickest to fix first when they weigh the same.

This week

The changes seen in the last seven days (new subdomains, ports, DNS and mail changes, certificates, look-alikes…), newest first. Timeline opens the full timeline of changes.

Coming due

What expires or needs a decision in the next 30 days: certificates of your hosts, and the review or expiry dates of accepted risks. Each line links to the page concerned and says how many days are left (or how long ago it was due). To have these dates in your own calendar, see the deadline calendar.

Trends across your domains

Two charts over the last 90 days (or the history of your plan, if shorter): the open findings by severity of all your proved domains added up day by day, each domain counted with its latest audit at that date, and the mean time to fix by severity, week by week, with the fixes of every domain together. The rule for a fix is the one of the domain’s page. Show the figures gives the numbers as a table.

The list of domains

Below the dashboard comes the list of every domain of the workspace, proved or not. See Your list of domains and their settings.

The page of a domain

Open a domain from the list. Its page is in tabs, each with an address of its own:

• Overview: the score and its history, the score by family, what changed since the last audit, and the three things to do first;
• Findings: every finding with its fix, the score simulator, the remediation plan and the DNS changes applied;
• E-mail: DMARC reports and the steps to p=reject;
• Web and certificates: availability, certificates issued, the WordPress site;
• Exposure: exploited vulnerabilities, impersonation, secrets in public code, look-alike domains;
• Proof: comparison with your peers, trends, attestations;
• Settings: frequency, options, public score, logo.

A link from an alert or an e-mail opens the right tab by itself. All on one page shows every card at once, as before, for example to print.