Methodology
How we assess, score and explain
We publish how scores and classifications are produced so that a number is never a mystery or a sales lever.
Scanner
Northstead Security assessments are built on Penthera, an open-source, rule-based security engine (MIT licence), wrapped in our own normalization, review and reporting. Every finding comes from a readable rule with its evidence. We pin the exact engine version and record it on every assessment and report.
Severity and confidence are separate
- Severity (Critical, High, Medium, Low, Informational) is the potential impact if the finding is real.
- Confidence (Confirmed, Likely, Potential, Requires human review) is how certain the observation is. A missing header is confirmed; a library version with published CVEs is likely; a version from a server banner is only potential.
Scores and counts never treat potential findings as confirmed vulnerabilities.
Passive snapshot score (passive-v1)
Each passive check has a weight. The score is the share of weight that passed, 0–100, computed from the checks that actually ran. Any failed critical check caps the score at 40; any failed high check caps it at 69. Weight-0 checks are notes and do not move the score.
| Area | Checks and weights |
|---|---|
| Connection | HTTPS 22 · HSTS 12 · TLS version 4 · certificate validity 4 |
| Browser protections | CSP 14 · framing 8 · nosniff 8 · referrer policy 4 · permissions policy 2 · CSP script sources 4 · CORS 4 (when present) |
| Disclosure and cookies | software disclosure 6 · cookie flags 8 (when cookies are set) |
| Page | secrets in page code 14 · vulnerable libraries 8 · mixed content 6 · SRI 4 · source maps 2 |
| Email and contact | DMARC 4 · SPF 3 · CAA 2 · security.txt 3 |
Bands: 90–100 strong basics · 70–89 good · 50–69 needs attention · below 50 at risk. The score describes observed configuration quality within the snapshot’s coverage. It is not a probability of compromise.
Verified reviews
Verified reviews report findings individually with evidence; we do not reduce them to a single number, because coverage differs between websites. Trend comparisons between assessments are only made when coverage is comparable, and improved visibility (for example after connecting source code) is shown as such, never as a deterioration.
Coverage and limitations
Every assessment lists what ran, what was skipped and why. An external scan cannot see source code, databases, internal networks, business-logic flaws, or anything behind authentication unless you provide it. Absence of findings is absence of visibility, not presence of security.
AI explanations
AI is used to explain findings, never to produce them. Explanations are generated from the finding’s own evidence with a strict output schema; statements about affected endpoints, exploitability, regulations or losses that are not supported by evidence are rejected. Website content, scanner output and customer text are treated as untrusted data.