External security evidence lives in many places: DNS, certificates, services and suppliers. An alert tells you something happened, but it rarely tells you who owns the next step. Cyber Health Score connects the signal, the decision and the evidence you can stand behind.

This is Northstar Systems, our fictional demo workspace. Its owner adds an isolated domain and proves control with a DNS record. That verification matters. Discovery may suggest a related name, but a graph edge or supplier declaration doesn't give anyone permission to assess it.

Think of DNS as a public directory of instructions. SPF says which senders are permitted to send mail for a domain. This demo has no mail sender configured. So a missing mail policy is a configuration fact; it isn't evidence that anyone has abused the domain.

DKIM lets a receiver check a message's signature against a public key in DNS. DMARC sets the policy for mail that fails aligned checks. Here, no DKIM selectors were supplied. We can't validate a selector we don't know. And none of these controls makes every message safe.

Once a domain is verified, the supported posture assessment can be queued. Queued isn't completed. A completed run records its checks, evidence and failures. In this demonstration, the manual bounded scan completed, while continuous assessment is temporarily unavailable. Passive discovery, schedules and service depth have separate states.

The latest completed scan gives this demo asset a score of sixty-eight. Beside it, you'll see the evidence date, partial confidence and module coverage. Two core modules completed; one failed, and exposure checks were skipped. Those limits belong with the score, not in fine print.

Inventory shows one verified root, its observed score and a completed scan. Discovery candidates have a separate review path. Northstar has none recorded yet. That means the workspace has no candidates to show; it doesn't mean there are no other systems on the internet.

Sankofa is the history view. It distinguishes scans and snapshots we recorded from views derived later. A point appears on the timeline only when there's a durable record behind it. The second scan left the score unchanged. That's a useful comparison, even without a dramatic improvement.

There are two active findings here: an HTTPS endpoint we couldn't reach and DKIM selectors that weren't provided. Severity gives the team a starting priority. Open a finding and you can see the evidence, the recommended action, the owner and the workflow state.

The synthetic owner took the DKIM issue, marked it in progress and noted that no signing service exists yet. Then a targeted verification scan completed. It still detected the issue, so we don't close it. A future fix would need a configured sender, DNS record and another completed check.

Atlas has several lenses, each bounded by recorded evidence. There isn't an active linked inventory graph in this demonstration. The trust lens does contain our fictional supplier. Select it and Missions keeps the entity and lens in context. It doesn't create an exposure edge or assessment authority.

Operations Pulse brings recorded signals together with source health and provenance. The current scan and snapshot are observed records. No exposure event is recorded here, but that's not a clean bill of health. The team can weigh importance and recurrence, then decide what deserves attention.

Northstar's hosting partner is fictional. Its profile records a declared business dependency and a fictional supplier domain. The profile still says active assessment authority: No. High business criticality tells us the relationship matters; it doesn't make that third-party system ours to test.

The Evidence Vault shows coverage, freshness, confidence and review state. Submission isn't review, and review isn't certification. In this demo, creating the supplier assurance review failed. There's no review record to rely on, so the trust-claim view remains empty.

Verifier is for scoped, authorised, non-restricted disclosure. There are no claims to verify in this workspace. If there were, you'd still need to see who issued each claim, what it covers, what evidence supports it, how fresh it is, and what it doesn't prove.

Decisions sit beside observations, not inside them. The finding assignment and status change carry actor context. Policy automation has capability limits, budgets, dry runs and approvals. This workspace has no policy configured, so I'm not showing an automated action that never happened.

The tenant assistant can help explain supported workspace evidence and guide an investigation. It's read-only here. It doesn't remediate systems. Integrations and continuous services also report their own availability. When a source is unavailable, the right answer is to say so clearly.

Reports capture a time-bounded state. Four were generated from these two assessments, though downloads are gated by plan. That's the operating loop: observe, understand, decide, act and verify. Share trust with the limits of the evidence still attached.