> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Security Center Overview: Issues, Scans, Domains and Exposure

The **Security Center** shows how your organisation looks from the outside – the same view an attacker has. Open it with **Security** in the top navigation. This article is a tour of its areas. To add your first domain, see "How to set up the Security Scan for your Domain".

## Overview

![Security Center overview with Security Score, coverage notice and key figures](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/security-overview_lmllos.jpg)

- **Security Score** – 0 to 100, based on your open and accepted issues. Resolved issues and false positives don't count. The card also lists hosts without current, complete scan coverage, because unscanned vulnerabilities may lower the score.
- **Scope** – look at all monitored domains or a single domain.
- **Open issues**, **Monitored domains** and **External exposure** at a glance, plus **Recent activity**.
- **Trends** tab – how your security posture, issues, sender authentication and scan results develop over time.
- **Download PDF** – a report with management summary, sender authentication, findings, port exposure, IP reputation, coverage, look-alike domains and methodology. Optionally include the scan history of the last twelve months. The report leaves out secrets, raw evidence, IP addresses and resolved or false-positive issues.

## Issues

All findings in one queue, split into three tabs:

- **Vulnerabilities** – findings from vulnerability scans
- **Domain threats** – look-alike domains (see "Look-alike Domain Monitoring and Security Alerts")
- **Sender authentication issues** – SPF, DKIM and DMARC problems

Click **How to fix** on an issue to expand it. You see the description, the **Recommended remediation** – often with a configuration example and references – and technical details such as the affected endpoint and when the issue was first and last seen.

![Expanded issue with description, recommended remediation and technical details](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/issue-detail_1xwv9g2.jpg)

Admins can also mark an issue as **False positive** (with a reason) or **Accept** the risk (with a reason and an expiry date of up to a year). Accepted risks still count towards the Security Score. Issues are resolved automatically once a later scan no longer finds them.

## Scans

Admins start a scan with **New scan**. The wizard asks what to scan, how deep, about access and schedule, and shows a summary before you start.

| Scan type | What it does | Credits |
| ---- | ---- | ---- |
| **Baseline** | Safe checks of the essentials of a host | One per host in each scan period of your plan (daily, weekly or monthly) included; additional Baseline scans 5 |
| **Expanded** | Broader discovery, more ports, crawling and safe tests | 30 |
| **Authenticated** | Expanded coverage using a login you provide | 45 |
| **Deep Active** | Active tests that can change data; requires explicit authorisation | 75 |

- Only hosts on verified domains can be scanned.
- **Deep Active** runs against the live system and may create, edit or delete records. You must confirm it by typing the exact host name – only use it if you are allowed to test that system and have a backup.
- **Expanded** scans can be scheduled to recur. Scheduled paid scans only run if you set a **Scheduled security scan credit limit** under **Settings → Billing → Billing settings**. It is 0 by default.
- A scan you cancel after it has started is still charged.

## Domains

All your monitored domains. Admins can add a domain with **Add domain** and verify it by e-mail or DNS TXT record. Each domain has its own pages for sender authentication, hosts, vulnerability scans and settings. In **Settings** you can switch **Email Alerts**, **Vulnerability Scans** and **External port exposure scanning** on or off.

Sender authentication and look-alike checks run daily for verified domains. To remove a verified domain, contact support.

## Exposure

- **Open ports** – publicly reachable services, labelled **Expected**, **Review** or **High risk**. These labels show how unusual a port is; they are not vulnerability severities.
- **IP reputation** – whether your IP addresses appear on public abuse lists. This is context only and does not affect your Security Score.

## Who can do what

All members of your company can view the Security Center and download the PDF. Starting scans, adding domains and changing the status of issues is reserved for company admins.