Northstar Family Dental
Illustrative business-owner report · Selected example findings
Start here.
Then work through the list.
In this example, possible remote access and email-domain protections need attention. Some website protections are already in place.
Ask your IT provider to review the first two items and agree an action plan this week.
This check cannot tell you whether a breach has occurred.
A possible remote-access opening needs review.
An unnecessary connection point could give someone another place to attempt access. The check identifies an opening, not a successful break-in.
“What is using this connection? Does it need to be reachable by the public? If it is remote access, can we restrict it safely?”
Technical details for your IT provider
Illustrative observation: a TCP connection was accepted at 203.0.113.25:3389. This is the default RDP port, but a connect-only check does not confirm the application, its authentication requirements, a vulnerability or compromise. No login or exploit was attempted.
Confirm the service and business need using authorized internal evidence. If it is remote administration, restrict direct exposure through an appropriate access design. Validate both the public result and legitimate staff access after any change.
Your exact email domain needs stronger impersonation protections.
The example business is missing a public email policy. Other email services have less guidance for handling fake messages that use its company domain—the part after @ in its email addresses. This can put customer trust at risk.
“Can you check all the services that send email for us, then set up and test the right domain policy without disrupting legitimate messages?”
Technical details for your email provider
Illustrative observation: no valid DMARC record at _dmarc.northstar-dental.example. Inventory legitimate senders and validate SPF/DKIM alignment before progressing from monitoring to an enforcement policy. A published monitoring policy alone does not request rejection. Check policy syntax and reporting as part of validation.
DMARC does not prevent lookalike-domain scams, every phishing message, or misuse of a genuinely compromised account. The checkup does not inspect mailbox contents.
Your website could use another browser protection.
A browser rule can help limit where a site loads certain content. Its absence alone does not prove the website is vulnerable or compromised.
“Can you review whether this protection suits our site, test it, and introduce it without breaking our forms or other features?”
Technical details for your website provider
Illustrative observation: the root HTTPS response lacked a Content-Security-Policy header. This is a limited observation, not proof that all routes lack protection. Review the application context and any other delivery mechanism before treating it as a confirmed gap. If appropriate, test a report-only policy and resolve legitimate-resource violations before enforcement.
What is already working?
In this example, the website supports encrypted connections and redirects visitors to the encrypted version. These are useful protections to preserve; they do not prove the entire site is secure.
Your handoff checklist
A plan with clear ownership.
| When | Business decision | Ask this person |
|---|---|---|
| First 7 days | Confirm the purpose of the exposed connection and restrict it if unnecessary. | IT provider |
| First 7 days | Begin reviewing the services that send company email and the appropriate domain policy. | Email administrator |
| Within 30 days | Decide and test the appropriate additional website protection. | Website provider |
| After changes | Request the included limited retest within 30 days of the original report. | Business owner + Wolex |
What this example does—and does not—show
This sample presents selected fictional observations, not a real assessment. It does not describe findings from a scan of a real business. The sample uses one documentation-only domain and IP address.
The paid service is limited to agreed public assets. It does not investigate a breach, test stolen credentials, inspect internal devices or cloud accounts, perform a penetration test, repair findings or certify compliance. Example priorities and timing are not universal deadlines.