Start with two things: the scan date, and the priority findings. The score is a convenient headline, but it never tells you which machine to log in to. The tables do.
Three counts that are not interchangeable
| Term | What it is | Why the count misleads |
|---|---|---|
| Hostname | A DNS name such as www.example.com | One name can hide a whole fleet |
| Endpoint | One address and port, in the context of a hostname | Ten affected endpoints is often one service behind a load balancer |
| Certificate | One certificate, which can sit on many endpoints and cover many names | One replacement can close findings on six servers |
The practical rule: never add counts across findings and treat the total as a number of broken services. Overlapping findings double-count the same box.
Read a finding from evidence to owner
For each finding, pull out the hostname, the address and port, and the observed behavior. Then answer the only question that matters for getting it fixed: who controls that TLS terminator? Your server team, the CDN, the hosting vendor, the DNS provider, or the mail provider. A ticket sent to the wrong one of those five comes back a week later unchanged.
Two traps worth naming, because they account for a lot of confusion:
- Modern support does not cancel old support. A hostname offering TLS 1.3 can offer TLS 1.0 at the same time. The finding is about what is still reachable, not about what a modern browser picks.
- IPv4 being healthy says nothing about IPv6. Same hostname, different machine, different certificate. Check both.
What severity actually claims
- Critical: a serious configuration problem. Investigate promptly.
- Warning: a weakness or a gap in a rollout. Needs review, not panic.
- Informational: context or an improvement opportunity, such as broader algorithm coverage.
None of these is a claim that an attack happened.
Headline severity and score severity can also differ, and that is deliberate. A headline groups observations for readability, while the score applies one rule at a time. The protocol headline lumps deprecated versions together, for example, while the score treats TLS 1.1 separately from TLS 1.0. If the two seem to disagree, the score breakdown is the place to look.
The AI summary is orientation, not evidence
Reports can include a generated narrative of the computed findings, with a standard fallback when it is unavailable. It is there to save you five minutes of reading.
Use it that way. The tables are the evidence, and when prose and an endpoint observation conflict, keep the observation and ask us about the prose.
A clean section may mean nothing was measured
The check that produced no finding because it never ran looks identical to the check that passed, unless you look.
Before you report a category as healthy, check the connection errors and read result states. Optional sections can also be simply absent in older reports, or where no corresponding data was collected.
When you have picked a finding, follow its link here for the interpretation and the fix. Carry the report date and the affected endpoints into whatever ticket you open.