Trust, measured
Don't take our word for it
— read the measurements.
A published precision/recall table, a fleet-wide time-to-safe split, a plain-language account of what "not checked" means, and the honest boundary of what we do not protect. Every number here is measured, not asserted.
Measured detection accuracy
We run a fixture lab of hand-built, ground-truth-labeled scenarios against our own detection logic on every change, and publish the result. A committed floor value fails the build if a module's measured precision or recall ever regresses.
| Module | Fixture cases | True positives | False positives | False negatives | Precision | Recall |
|---|---|---|---|---|---|---|
| Sensitive Paths | 13 | 7 | 0 | 0 | 100% | 100% |
| Exposed Keys | 13 | 8 | 0 | 0 | 100% | 100% |
| Subdomain Takeover | 11 | 5 | 0 | 0 | 100% | 100% |
| Email security | 17 | 11 | 0 | 0 | 100% | 100% |
Time to safe, fleet-wide
Two different guarantees, always shown separately — never blended into one self-congratulating number. This is a fleet-wide aggregate across every organisation we protect; we never publish, or even compute for this page, any single customer's own number.
—
Fleet stats published as we reach statistical significance — 0 of 25 findings measured so far
—
Fleet stats published as we reach statistical significance — 0 of 25 findings measured so far
What "not checked" means
Every scan we run publishes a coverage manifest — "X of Y checks ran" — instead of letting a skipped check silently read as a pass. A check can land in one of a few honest states:
- Checked, clean
- The check ran and found nothing to flag.
- Checked, found (and fixed or flagged)
- The check ran, found a real issue, and either fixed it automatically or handed you the exact next step.
- Checked, evidence attached
- Where we can, we keep proof — a captured response, a screenshot — instead of asking you to trust a green result blindly.
- Not checked
- A data source isn't connected, the check needs a higher plan, or it's temporarily unavailable. We show this out loud instead of letting a skipped check read as "passed".
- Not applicable
- The check doesn't apply to your stack — e.g. a WordPress-specific check on a site that isn't running WordPress.
- Inconclusive
- We probed, but the signal wasn't clear enough to call it either way — flagged as inconclusive rather than forced into a false "clean" or a false alarm.
We show "not checked" out loud because a false sense of coverage is more dangerous than an honest gap — you can act on a gap you know about.
What we do not protect
8 structural blind spots, named out loud in every scan and every report — never hidden behind a green result.
- Malware, infostealers, and ransomware running on your computers
- Stolen login sessions and MFA-bypass attacks
- Payment fraud from a vendor's own real mailbox
- Phishing email that lands in your inbox
- Exploits against VPNs, firewalls, and remote-access boxes
- Data leaving your network
- Flaws behind a login (authenticated application testing)
- Insiders, physical access, deepfake fraud, and shadow SaaS