Got a Scary Cybersecurity Report? Here's What It Actually Measured
A business owner forwards us a PDF.
Black background. Red numbers. A gauge needle buried in the danger zone. Five accounts on the dark web. A 50% "cyber score." A three-step diagram showing how criminals will profile employees, find passwords, and empty a bank account.
The first question is almost never "Is this accurate?"
It's "How bad is this?"
That reaction is the point. The report is the delivery system.
If you just got one of these in Greenville or anywhere in the Upstate, this post is for you. We'll walk through what those reports actually look at, what they can't see, how to spot the sales tricks, and what to do next without panic-buying a new IT contract.
---
What a cyber score report actually checks
Most of these documents pull from the same four public data sources:
- DNS and email authentication records — SPF, DKIM, and DMARC. Published on purpose so mail systems can check them. Anyone can read them.
- Certificate data — Your SSL/TLS certificate and its chain, pulled from public certificate transparency logs.
- HTTP response headers — What your website sends back when a browser requests a page.
- Third-party breach corpora — Aggregated dumps of credentials stolen from *other* companies' systems over the years.
That's it.
No login. No agent on your computers. No conversation with anyone who runs your Microsoft 365 tenant, firewalls, or backups. The whole thing is usually an API call against a domain name, and it finishes in about thirty seconds.
Useful as a quick outside look? Sometimes. A full picture of whether your business can survive a real incident? No.
---
What an outside scan structurally cannot see
Here is the part that rarely shows up on the scorecard — because a scanner standing outside your building cannot evaluate any of it:
- Whether multi-factor authentication (MFA) is enforced, and on which apps
- Whether your PCs and servers are patched, and how fast
- Whether backups exist, whether they're immutable, and whether anyone has ever restored from them
- Whether admin accounts are separated from day-to-day logins
- Whether a departed employee's mailbox is still active
- Whether endpoint protection is actually running on every device — or just licensed for them
- Whether anyone would notice a login from an unfamiliar country at 3 a.m.
Those controls decide whether a firm absorbs an incident or gets knocked flat by one.
None of them are scored. None of them are scoreable from the outside.
A report that skips every factor that determines the outcome is not measuring your security posture. It is measuring your DNS records and calling it a posture.
---
Three tells that you're looking at a sales artifact
Once you've seen a few of these, the construction gets obvious.
1) Unknowns get dressed up as failures
The scanner hits a control it can't evaluate and returns "unable to verify." That result gets a grey icon and lands in the same column as the real failures.
Visually, the column looks like a wall of problems. Substantively, half of it is the tool admitting it couldn't get an answer. A limitation of the scanner gets presented as a weakness of *your* business.
2) A universal condition gets scored as a specific finding
Almost every organization with any tenure has *some* credentials sitting in breach corpora somewhere. Not because they were hacked — because a vendor, a conference registration site, or an old software portal was.
Flagging that as a finding guarantees a red mark on nearly every report the tool ever produces. That's not a diagnosis. That's a feature of the scoring model.
What actually matters:
- Are those credentials still current?
- Were they reused on other sites?
- Is MFA sitting behind them?
The scanner can't answer any of those three, so it counts the exposure and moves on.
3) One control gets counted as many failures
"Missing 12 important security settings" sounds like twelve holes. It is usually a single category — optional HTTP response headers — enumerated one by one to produce a bigger number.
Some of those headers are worth adding. Some are meaningless on a marketing site that stores no customer data and holds no sessions. Counting them separately isn't analysis. It's arithmetic in service of a headline.
---
Why these reports exist
These PDFs are not, for the most part, written by the security firm whose logo sits in the corner. They are generated by third-party platforms that sell prospecting tools to IT providers, priced per scan.
You can read the sales guides. They're public. They tell the reseller to open with exactly two topics — dark web exposure and email impersonation — not because those are always the highest-risk findings, but because they're the two a non-technical owner will find alarming without needing a long explanation.
Then the guide says: stop talking and watch the reaction. If the owner leans in, they're a live prospect. If they shrug, write them off and ask for referrals instead.
That is not a security methodology. That is a qualification script, and the report is the prop.
We want to be careful here. Plenty of the vendors building these tools are legitimate companies with real products. The problem isn't that every scan is a scam. The problem is that a sales artifact and an assessment are different objects — and one is being handed to business owners while wearing the costume of the other.
---
Scan vs. assessment: the difference that matters
| | Outside-in cyber score / dark web PDF | Real security assessment |
| --- | --- | --- |
| How long | ~30 seconds | Hours to days, with human review |
| Access | Domain name only | Your environment, policies, and people |
| What it sees | Public DNS, certs, headers, breach dumps | MFA, patching, backups, account lifecycle, endpoints, email controls |
| Best use | Directional hygiene check | Decide what to fix and in what order |
| Worst use | Panic purchase based on a gauge needle | Treating a prospecting PDF like an audit |
If a report makes you feel something before it tells you anything, that ordering was deliberate.
---
What we do instead at PremierePC
We verify before we alarm. When something surfaces, we check it. Free tools will tell you in thirty seconds whether a certificate is valid or a TLS configuration is sound — Why No Padlock and Qualys SSL Labs are both free, no account required. We've seen reports flag clients for SSL problems on sites with perfectly healthy certificates. Running the check takes less time than reading the paragraph that made the claim.
Our dark web monitoring is about triage, not theater. A hit where only a name and an email address were exposed is not the same as a hit where a working password was exposed. We separate the two and report the ones that matter. Inflating the count is easy. Triaging it is the actual work — and it's the difference between a client who acts on alerts and a client who learns to ignore them. Learn more about our security awareness training and dark web monitoring.
We train continuously, not once a year. Weekly micro-trainings, annual certification, phishing simulations, and AI-security coursework — available through the portal or inside Microsoft Teams. We score participation at the individual level so leadership can see who's engaged and who never got the invitation. A phishing click rate is a real number about real human behavior. It beats a gauge needle.
We manage the controls that get scored — and the ones that don't. Publishing and enforcing DMARC. Putting a secure email gateway in front of mailboxes. Those show up green on scorecards, which is fine. But the things that actually determine survivability — MFA enforcement, patch cadence, backup integrity, account lifecycle, dormant mailbox cleanup — those are the ones we're paid to care about. None of them fit in a gauge. See how that fits into managed cybersecurity and business IT support.
---
Got one of these reports? Forward it.
We'll read your scary report for free.
Email it over, book a conversation, or call (864) 335-9223. We'll tell you which findings are real, which are artifacts of the scan, and what — if anything — needs doing.
Sometimes the answer is that there's a genuine gap and we should fix it.
More often the answer is that you were scanned, not assessed — and the difference is the entire point.
Fear is easy to manufacture and expensive to act on. If a report makes you feel something before it tells you anything, pause. Then get a second set of eyes that aren't trying to close a deal on the same PDF.
---
FAQ
Is a cyber score report a real security assessment?
Usually no. Most cyber score and dark web PDFs are outside-in scans of public data — DNS records, certificates, website headers, and breach dumps. A real assessment looks at MFA, patching, backups, account controls, and how your team would respond to an incident.
Should I ignore a dark web finding completely?
No. Credentials in breach data can still matter — especially if passwords were reused or MFA isn't on. The right move is triage: what's exposed, is it still valid, and what do we change next? Don't treat every email address on a list like an active break-in.
Why do so many IT companies send these reports?
Third-party platforms sell them as prospecting tools. The report opens the conversation. Dark web exposure and email impersonation are favored openers because they scare non-technical owners quickly. Some findings are real. Many are framed for sales momentum.
What should a Greenville small business do after receiving one?
Don't panic. Don't sign anything based on a gauge needle alone. Forward the PDF to an IT partner you trust — or to us — and ask three questions: What's verified? What's unverifiable noise? What would you fix first if this were your business?
Does PremierePC use scary scorecards to sell?
We use monitoring and training scores to help clients improve over time — not to manufacture urgency from a 30-second domain scan. If you already got a scary PDF from someone else, we'll review it straight: what's real, what's theater, and what to do next.