XertyFi Security Assessment Report
Northstar Family Health — northstarhealth.example
Report ID: XF-SAMPLE-2026-001 · Assessment Date: January 15, 2026
Executive Summary
Northstar Family Health's external security assessment identified several areas for improvement, primarily related to HTTP security headers and email-domain protection. The overall security posture is moderate, with a score of 82 out of 100. Two high-severity findings should be addressed immediately to reduce exposure to common web-based attacks.
82
Security Score
Medium Risk
Risk Level
4
Findings
Risk Distribution
0
Critical
2
High
2
Medium
0
Low
Assessment Scope
- • Asset assessed: northstarhealth.example (domain)
- • Assessment type: External, non-intrusive
- • Categories reviewed: SSL/TLS, DNS, HTTP headers, exposed services, email security, technology fingerprinting
- • Methodology: Passive external analysis using publicly available information
Example Findings
Missing HSTS Security Header
Category: HTTP Security Headers
Evidence: The HTTP Strict-Transport-Security header was not present in the server response.
Business Impact: Without HSTS, browsers may allow insecure connections, exposing users to man-in-the-middle attacks.
Recommendation: Add the Strict-Transport-Security header with a max-age of at least 31536000 seconds and includeSubDomains.
Priority: Immediate (0–7 days)
Estimated Effort: Low
Content-Security-Policy Not Configured
Category: HTTP Security Headers
Evidence: No Content-Security-Policy header was detected in the response.
Business Impact: Without CSP, the site is more vulnerable to cross-site scripting (XSS) and data injection attacks.
Recommendation: Implement a Content-Security-Policy header that restricts resource loading to trusted sources.
Priority: Immediate (0–7 days)
Estimated Effort: Medium
Server Version Disclosure
Category: Information Disclosure
Evidence: The server header reveals the exact software version in use.
Business Impact: Attackers can use this information to identify known vulnerabilities for the specific version.
Recommendation: Configure the server to suppress version information in response headers.
Priority: Near term (8–30 days)
Estimated Effort: Low
DMARC Record Not Configured
Category: Email Security
Evidence: No DMARC record was found in DNS.
Business Impact: Without DMARC, email spoofing and phishing attacks using your domain are more likely to succeed.
Recommendation: Add a DMARC TXT record starting with "v=DMARC1" with at least a monitoring policy (p=none).
Priority: Near term (8–30 days)
Estimated Effort: Low
Positive Findings
Valid SSL/TLS Certificate
The domain has a valid SSL certificate from a recognized certificate authority.
TLS 1.2+ Supported
The server supports modern TLS protocol versions.
DNSSEC Enabled
DNS Security Extensions are configured for the domain.
Limitations & Disclaimer
• This is an external, point-in-time assessment. Results reflect the state of the assessed domain at the time of scanning.
• False positives and false negatives are possible. Findings should be validated before remediation.
• This report does not guarantee security or the absence of vulnerabilities.
• This report does not constitute legal advice, regulatory certification, or compliance attestation.
• This assessment does not include internal network testing, credentialed application testing, or active exploitation.