A scan can finish successfully with several checks that never produced an answer. Complete means the report is ready. It does not mean every endpoint was reached.
This page exists because the two most dangerous words in any security report are “no findings.”
What each state is telling you
| Result | What it establishes | What to do |
|---|---|---|
| Supported, present, observed | The probe found the feature or behavior | Read its value. Presence is not the same as a good policy |
| Unsupported, absent | The probe ran and the feature was not there | Decide whether this service should have it |
| Unknown, unavailable | Not enough usable evidence, or not assessable here | Check errors and applicability before changing anything |
| Timeout, error | The attempt failed or errored out | Read the error text, check reachability, retest |
| Not attempted | The probe never ran, often because an earlier step failed | Fix the earlier failure first, then reassess |
| Not applicable | The check does not apply to this service role | Not a missing protection. Leave it |
| Partial, truncated | Only some of the evidence came back | Draw no conclusion about the part you cannot see |
These are the general meanings. Individual sections use more specific labels, such as DNSSEC’s bogus or OCSP’s Not Available.
Absence and invalidity need opposite responses
Four pairs that get conflated constantly:
- No DNSSEC is a deployment decision. Bogus DNSSEC is an outage waiting to happen at every validating resolver. See DNSSEC validation and zone findings.
- Missing HSTS means a header was not sent, which is usually a layer stripping it. Failed HTTPS connection means you have no idea what headers are sent.
- No stapled OCSP response says nothing about revocation. Revoked says everything. Each stapling result, in order of urgency.
- No weak ciphers listed on an endpoint whose handshake failed is not a clean cipher result. It is no result.
That last one is the trap. An endpoint that failed the handshake has not passed the cipher, protocol, and certificate checks that depend on the handshake completing. It has skipped them.
When there is no report at all
If no reachable TLS endpoint can be verified, the scan can end as unscannable rather than producing a scored report. That is not zero out of one hundred on a completed assessment, it is the absence of an assessment.
Check the domain, its public DNS, and whether the service is exposed where you think it is. Discovery and coverage explains what an external scan can reach. Scans can also fail for other reasons and show an error instead of a report.
When to run it again
Retest after a configuration change, after fixing a lookup or connectivity problem, or when the report is simply older than the decision you are making. Fixing findings and verifying changes covers the loop.
A repeated timeout may be your access policy working exactly as designed. Do not open something up to satisfy a scanner.
If a result still looks wrong, send support the scan link, the hostname, the affected address and port, and what you expected to see. Share full-access report links only with people who should have the whole report.