Coverage
Negative coverage is information too.
A report that lists only what was found tells you nothing about what was looked for. Seccuti records the classes it exercised, the ones it covered only in part, and the ones your action policy did not permit.
Why show what was not tested?
Because the gap between what a customer assumes was covered and what actually ran is where the next incident lives.
TESTEDInjectionparameters discovered and exercised
TESTEDBroken access controltwo identities compared
PARTIALAuthenticationno second factor available on the test account
NOT TESTEDCredential testingaction class disabled by your policy
NOT TESTEDDenial of servicedestructive class, never enabled by default
A class shown as not tested is a decision you made, surfaced back to you. If it should have been covered, enable it and run again.
See the coverage on a real target.
The matrix is part of every engagement.