Run a check and you'll get three things: a grade, ten scored checks, and a much longer checklist underneath. Here's what each part is actually telling you.
The grade
The letter grade is a rollup of the ten external checks - TLS, headers, DNS/email authentication, subdomain exposure, cookies, leaked secrets, third-party scripts, CORS, tech fingerprinting, and edge/MFA signals. It's a fair summary of your externally visible hygiene. It is not, and was never meant to be, a compliance score.
One deliberate behaviour worth knowing: if too few checks complete, no grade is shown at all. A report that graded you on two checks out of ten would be flattering and meaningless - a site that blocks the scanner entirely would score well for being opaque. Below a coverage threshold you get N/A and an explanation instead.
The ten checks
Each one is tagged with the SOC 2 Trust Services Criterion it touches - CC6, CC7, and so on - because these checks genuinely do relate to real criteria. The tag just marks the visible slice of that criterion, not the whole thing. A green dot on "security headers" means your headers are set well; it says nothing about the criteria that headers only partly support.
Each finding opens to show what to do about it. The individual subjects are covered in more depth in email authentication, TLS, headers, subdomains and exposed secrets.
Undetermined results
Some checks come back as undetermined rather than pass or fail. That means the evidence wasn't gathered - the site returned an error page instead of the homepage, a lookup service was unreachable, or the host refused the request. These are excluded from the grade rather than counted against you, because a check that didn't run is not a check that passed.
The checklist underneath
This is the part most tools skip. Six categories, eighteen questions, covering the parts of SOC 2 that no scan can verify. Each question has a "Tell us what you know" option - answer what you're sure of, and get an immediate, specific note back, not a generic score. Answer honestly, including "not sure": that answer is itself useful information, and every question links to plain-language directions for finding out.
What to actually do with it
Treat the grade as a floor, not a ceiling. The real work - and the real value of getting audit-ready - is in the checklist below it. Work through what you can answer yourself first, then bring in whoever owns the rest.
For the map of what that checklist is covering, see the 80% a domain scan can't see. For the standard the checklist is shaped around, see what SOC 2 is and what it actually asks of you.