SurfaceGuarda Nuvtek service
NLEN
Request an assessment

Sample report

This is what your report looks like

Below is the structure of a SurfaceGuard report for a fictional company. All names, addresses and findings are made up for illustration.

1 · Executive summary

Know where you stand on one page

For management: a risk score, the spread of findings and the three things to fix first. No jargon.

Example Company Ltd

scope: example-company.com
42
Improvement neededWe found 31 assets, 6 of which were unknown to the IT department. Two findings need action this week.
Critical
1
High
2
Medium
4
Low
2

Example data for illustration.

2 · Asset overview

Everything we found, in one list

A complete list of the domains, IP addresses and services we found. Assets that weren't on your own list are marked separately.

AssetTypeServicesKnown to ITFindings
example-company.comWebsite80, 443Yes1
vpn.example-company.comVPN gateway443Yes1
test.example-company.comWebsite80No2
203.0.113.27Server3389No1
old.example-company.comWebsite443No1
mail.example-company.comMail server25, 587Yes0

Shortened example. The full report lists all 31 assets.

3 · Findings

For each finding: what, why and how to fix it

For your IT department or supplier: the evidence, the impact and the concrete fix.

VPN gateway runs outdated firmware

critical
SG-001vpn.example-company.comport 443
What we saw
The VPN login page shows a firmware version with a publicly known vulnerability that is being actively exploited.
Evidence
GET https://vpn.example-company.com/remote/login
        Server version (from page): 7.0.11
Impact
An attacker may be able to access the internal network without a password.
Fix
Update the firmware to the vendor's latest version. Then check the logs for suspicious login attempts.

Remote Desktop reachable from the internet

high
SG-002203.0.113.27port 3389
What we saw
Remote Desktop (RDP) is directly reachable on this IP address. This system wasn't on the IT department's list.
Impact
Open RDP is a common entry point for ransomware, through guessed or leaked passwords.
Fix
Close port 3389 in the firewall. Only allow access through a VPN with two-factor authentication.

No DMARC policy on the main domain

medium
SG-005example-company.comDNS
What we saw
The DMARC record is set to p=none. Receiving mail servers aren't told to reject forged mail.
Evidence
_dmarc.example-company.com  TXT  "v=DMARC1; p=none"
Impact
Criminals can send email that appears to come from your domain, such as fake invoices.
Fix
First make sure all your legitimate mail uses SPF and DKIM. Then move the policy step by step to quarantine and reject.

4 · Action plan

What to tackle when

this week

Remove direct risk

  • Update the VPN firmware
  • Close RDP on 203.0.113.27
this month

Clean up

  • Take test.example-company.com offline
  • Replace the expired certificate on old.example-company.com or remove the site
this quarter

Improve structurally

  • Move DMARC step by step to reject
  • Security headers on all websites
  • Add the 6 new assets to the asset list

A report like this for your organisation?

A one-off assessment costs €500 excl. VAT for one main domain.

Request an assessment