Trust Report¶
The Trust Report is what your instance measured about itself, and what it did not. You generate it from your own installation, on your own data, and hand it to whoever is asking how much the numbers can be trusted.
That is usually an auditor, a customer's security team, or the person who has to sign off on your vulnerability process.
Generating one¶
There is no menu entry: open /admin/trust-report directly, and only a super administrator can. The report is read-only: it reads results that were already measured on a schedule, and never starts a new measurement. Opening it does not put load on your instance.
What is in it¶
For each internal check the instance runs, the report says:
- what was measured
- when
- with which method
- what was not judged, and why
That last line is the one that matters at audit time, and it is the reason the report exists. A number with nothing behind it is a claim. A number that also says what it could not cover is evidence.
The four rules it follows¶
A missing measurement is reported as missing. A check that never ran on this instance appears as "not measured", never as zero. Zero would read as "we looked and found nothing", which is a different statement.
Abstention is declared. Every check names what it did not judge and why. A consolidated list at the end is the honest version of "clean": everything the instance is confident about, and everything it deliberately did not rule on.
No model takes part. The findings come from declared rules applied to declared data, so the same inventory and the same feed give the same result every time. The report says so, because it is a question buyers ask.
Precision first. Where a version cannot be compared or a piece of software cannot be tied to a published identity, the engine abstains and says so instead of guessing. Those abstentions are listed rather than hidden.
When to generate one¶
- An auditor asks how you know your inventory is complete
- A customer's security questionnaire asks about your vulnerability process
- Before a renewal, as the evidence that the year's findings meant something
- After a big inventory change, to see what is not yet covered
What it is not¶
It is not the list of your vulnerabilities. That is the dashboard, and the exportable version is under Exports.
The Trust Report is one level up: not "what did you find", but "how far can I trust what you found".