How our assessments work.
A useful security report must explain exactly what was checked, what was not checked and why the results should not be treated as certification.
Domain control and authorisation
Before any live website check, the requester must prove control by publishing an unpredictable verification line at an exact HTTPS well-known URL. Requests are scoped to that hostname and verification expires after 30 days.
Website-header review
After verification, Sentinel makes a read-only HTTPS request to the domain's home page and assesses observed headers: HSTS (20 points), Content Security Policy (25), MIME sniffing (15), anti-framing (15), Referrer-Policy (15) and Permissions-Policy (10). Results are a weighted indicator of header configuration only.
We do not scan plugins, enumerate endpoints, launch exploits, assess private infrastructure or verify full application security. We do not claim header presence guarantees effective protection.
Training scores
Threat simulation event lines are fictional. The simulator maps the defensive controls you select to scenario-specific recommended controls. Coverage indicates selections in a tabletop scenario, not verified effectiveness or actual SIEM integration.
NDPA readiness
Readiness responses are self-attested. The score is an arithmetic summary of yes/partial/no/unknown answers and does not prove legal compliance, regulatory approval or audit readiness.
AI remediation suggestions
Cloudflare Workers AI may summarise verified security findings, subject to quota and availability. The model receives limited report items, not credentials or the full target website contents. Generated wording needs technical review.
Data and retention
Web security reports and domain verification records are attached to a pseudonymous guest session and are deleted after 30 days or upon session deletion. Training, risk-register and readiness entries are browser-local. See the privacy policy for details.