Can we assume a secure system with 100 points?

No. The score describes what's detectable from outside. It says nothing about the internal state — that would need access to the system.

Why does this audit area never assign the "critical" level?

Because it can't know whether a visible version is actually exploitable. The highest level is "severe", and that only applies with documented end of maintenance.

This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →

Nothing detected doesn't mean secure

A result of 100 points means: nothing unfavourable is detectable from outside. It explicitly does NOT mean the installation is secure, current, or maintained. This boundary is stated in the rule set itself, too.

The audit service looks exclusively at what the page delivers on its own. An outdated installation that hides its version gets a full score here — and is still outdated.
That's why the measurement core treats "nothing detected" as its own finding type, and explicitly not as confirmation. The same stance holds across the whole service: an empty check counts as an error, never as a free pass.
Anyone who needs a statement about the actual condition needs access to the system — a completely different kind of check, which this service deliberately doesn't offer.

Deutsche Fassung — mit allen Prüfpunkten dieses Themas