ISAIntelligent Security Advisor

Help and documentation

How ISA works, in the order you'll use it.

Getting started

  1. Create an organization for your company (or one per client if you are a consultant).
  2. Register assets: a website URL, root domain, subdomain, server hostname, single public IP address or email domain.
  3. Verify ownership of each asset. Unverified assets cannot be scanned.
  4. Run a scan, read the findings, fix what matters most, and recheck.

Verifying ownership

ISA only tests systems you have proven you control, and the proof covers only the exact host you verified, never parent domains, sibling hosts or whole IP ranges. Three methods are available:

  • DNS TXT record. Add a TXT record at _isa-verification.<your host> with the value ISA shows you.
  • Verification file. Publish a small text file at /.well-known/isa-verification.txt on the site itself. Redirects to other hosts are not followed.
  • Administrator review. Upload a signed authorization letter when you are permitted to test a system you cannot modify. An administrator approves or rejects it.

Verification lasts 90 days. After that, verify again to continue scanning.

Running scans

Quick checks HTTPS, headers, DNS and the certificate. Standard adds email authentication, technology and CMS detection and a limited port scan. Custom lets you pick checks. The port scan only probes the ports your administrator approved, uses ordinary TCP connections, and never runs Nmap scripts. ISA never exploits vulnerabilities, guesses passwords or load-tests your systems.

Scans run in the background. You can leave the progress page; results are saved and you'll get a notification.

Understanding the score

Every scan gets a score from 0 to 100, calculated by a fixed formula, so the same evidence always produces the same result. Six categories are weighted: HTTPS & TLS 20%, security headers 15%, DNS 15%, email 15%, network exposure 20% and web technologies 15%.

Each category starts at 100 and loses points for each problem: 45 for critical, 25 for high, 12 for medium and 5 for low severity, reduced when ISA is less certain. The overall score is the weighted average of the categories that were actually assessed.

Coverage is shown next to every score. It tells you how much of the assessment completed. A Quick scan, or a scan where a check failed, has lower coverage; scores below 70% coverage are marked provisional and cannot reach the Excellent band. Under 30% coverage, no score is issued.

A confirmed critical finding caps the score at 39, a confirmed high finding at 74, and three or more highs at 59, so one serious issue cannot be averaged away.

Working through findings

Each finding shows a plain-language explanation, why it matters, how to fix it (with Apache, Nginx and IIS examples where relevant) and how to check the fix. Confirmed findings were directly observed. Suspected findings, such as those based on a version number, need checking before you act.

Statuses: Open, In progress, Ready for verification, Resolved, Accepted risk and False positive. Accepted risk and false positive require a written reason. When a recheck no longer observes a problem, ISA resolves it automatically; if it reappears later, ISA reopens it.

AI explanations and privacy

AI explanations are optional. An administrator connects Google Gemini, OpenAI or Anthropic Claude using an API key, and an organization owner must separately allow sharing for each organization.

Before anything is sent, ISA removes hostnames, IP addresses, email addresses, cookies and anything resembling a secret. Only the details of a single finding (or the list of finding titles for a scan summary) are sent, never full reports or asset inventories. AI text is checked before display: answers that are not valid, or that mention vulnerabilities ISA did not find, are discarded or cleaned. AI never changes scores or severities.

Without AI, everything else still works, including standard guidance on every finding.

Reports

The executive report explains the score, business risks and a prioritised plan. The technical report adds evidence, server configuration examples and verification steps. Both state the scan's coverage and limitations. Download them as PDF from the Report center, or print the browser version.

Roles and access

  • Owner: everything in the organization, including members and AI sharing.
  • Manager: register and verify assets, run scans, manage findings.
  • Analyst: update findings and generate reports. Requires a Security Analyst account.
  • Viewer: read only.

Super Administrators manage users, scan policy, AI providers and system health across the whole installation.

Common questions

My scan is stuck in "Queued".

No scan worker is running. An administrator should run sudo systemctl status isa-worker@1 on the server.

Why is DKIM "inconclusive"?

DKIM keys live under selector names that cannot be listed from DNS. Add your selectors to the asset details and scan again.

Why does a missing header not always lower my score much?

Some headers matter more than others. ISA avoids treating every absent header as critical; Permissions-Policy, for example, is informational.

Is the score a certification?

No. It is ISA's own indicator to help you prioritise. It does not replace a penetration test or a compliance audit.