Network exposure reports

What you will see

Each completed t_scan_reports row stores:

• the network string that was scanned
• start and finish timestamps
• host count and open-port count for a dashboard glance
• a JSON document of hosts → open ports → protocol, service, product, version
• email delivery status when report mail is enabled

How to read it

Start with the totals. A /24 that shows three hosts and five open ports is a different conversation from a /24 with forty listeners. Then walk host by host. Anything that is not HTTP/HTTPS/SSH on expected boxes deserves a ticket: RDP on the internet, database ports, unauthenticated admin panels, forgotten test appliances.

Use Reading a port scan report as a checklist, and Open ports that matter for the usual suspects.

Cadence

Default interval is six months. Twelve months is available if the range is stable. The next run date is chosen when you configure the scan. After a successful scanner run, that date advances by the interval. Failed runs do not advance, so the work remains due.

This is not a score

PortSweep does not grade you, does not CVE-match, and does not claim a host is “secure” because a port is filtered. Filtered means we could not tell. Closed means the host spoke and nothing was bound on that port. Open means something is reachable from the scan node — which is an internet vantage point, not an insider on your LAN.