Methodology.
The method behind the outside record of trust: exactly what we read and the check behind every finding. How an External Cybersecurity Assessment is done, written so an insurer, a lawyer or a regulator can quote it.
Attackers now use AI to read a firm the way a search engine does: the website, directories, search results and what AI assistants say. We read it first and every finding is human-verified before your assessment is released.
In 2025 the FBI recorded $3,046,598,558 in reported losses to business email compromise in the United States. FBI IC3, 2025 Internet Crime Report.
Read-only, externally.
Every signal comes from a public source and every finding carries the command or public source that proves it, so anyone can re-run it. Nothing is logged into. No penetration test is performed.
Five groups, each finding with its evidence.
dig TXT _dmarc.yourfirm.com returns the same record for anyone.The full list of categories, as the assessment documents name them
Every technique, one row each.
Up to 350 look-alike addresses an attacker could register from your name, checked on each reading.
52 techniques attackers use against firms like yours, each checked externally on every reading.
11 routes to your money, your clients, your accounts and your name, checked end to end on each reading.
| What an attacker's AI agent would try | How many | Checks on each and what they are | Up to |
|---|---|---|---|
| Web addresses that look like yours | 350 | 10: does it exist, where its mail goes, who runs its name servers, whether it has a website and a www, its sender rules, its refusal rule, checks against your own records | 3,500 |
| Other web addresses under your domain | 50 | 3: where it points, then the page over secure and plain web | 150 |
| Doors on your servers | 15 ports on each of 8 hosts | 1 connection each: does the door answer and what is behind it | 120 |
| Files your site should not show | 26 known paths and 1 catch-all probe | 1 read each: does the file answer at its public address | 27 |
| Every other domain your firm owns | 8 | 4: its refusal rule, sender rules, mail, certificate. Its open services and its registry lock are the next two rows | 32 |
| Doors on the servers of your other domains | 15 ports on each of 16 addresses | 1 connection each: does the door answer and what is behind it | 240 |
| Registry lock on each of your other domains | 8 | 1 read each: whether the registry blocks a transfer | 8 |
| Registration dates of look-alikes | 12 | 1 read each: when the name was registered | 12 |
| Pages of look-alikes and your own page | 7 | 5 reads each: the page and any redirect it follows | 35 |
| How look-alikes show to AI tools | 6 | 7 reads each: their robots rules, sitemap and index | 42 |
| Pages of your website | 30 pages and 1 robots file | 1 read each: the page as any visitor sees it with its forms and scripts. The robots file is one more read | 31 |
| Admin, console and API addresses | 40 | 1 read each: does a sign-in, console or API description answer at its public address | 40 |
| Documents your pages link to | 10 | 1 read each: the details stored inside the file | 10 |
| In all | 4,247 |
The ceiling of one assessment, up to 4,247 separate checks, counts the probes listed above. It does not count, among others, your staff's addresses in breach data, the spam, phishing and malware lists, the questions to AI tools, the single records of your own domain, the reads of the script files on your website, the look-ups of domains in the names of the people your firm's pages name and the mail, name-server and redirect reads that find which other domains your firm owns.
| Technique | Read on | Stage | Reference |
|---|---|---|---|
| DMARC rule | every reading | A | T1590.002 |
| SPF record | every reading | A | T1590.002 |
| DKIM signing keys | every reading | A | T1590.002 |
| MTA-STS policy | every reading | A | T1590.002 |
| TLS-RPT record | every reading | A | T1590.002 |
| BIMI record | every reading | A | T1590.002 |
| Mail servers and the mail provider | every reading | A | T1590.002 |
| DNS signing (DNSSEC) | every reading | A | T1590.002 |
| Services the firm points its domain at | every reading | A | T1590.002 |
| Domain blocklist listings | every reading | A | T1596.005 |
| Registration record | every reading | A | T1596.002 |
| Registrar transfer lock | every reading | A | T1596.002 |
| SPF lookup depth | every reading | A | T1590.002 |
| DMARC report address | every reading | A | T1590.002 |
| Null MX beside a website | every reading | A | T1590.002 |
| Certificate authority restriction (CAA) | every reading | A | T1590.002 |
| Microsoft 365 tenant | every reading | A | T1590.002 |
| Security contact file | every reading | A | T1594 |
| Canadian registry record | every reading | A | T1596.002 |
| Website certificate | every reading | A | T1596.003 |
| Trust of the certificate chain | every reading | A | T1596.003 |
| Browser protection headers and cookies | every reading | A | T1594 |
| Redirect behaviour | every reading | A | T1594 |
| Robots and sitemap files | every reading | A | T1594 |
| Site software and trackers | every reading | A | T1592.002 |
| Firewall in front of the site | every reading | A | T1590.006 |
| Script library versions | every reading | A | T1595.002 |
| Keys left in the site code | every reading | A | T1594 |
| Browser-security grade | every reading | A | none fits |
| Reputation of the addresses | every reading | A | T1596.005 |
| What internet-wide scan databases hold | every reading | A | T1596.005 |
| Other sites on the same host | every reading | A | T1590.005 |
| Host names of the firm | every reading | A | T1590.002 |
| Names in certificate logs | every reading | A | T1596.003 |
| Host names pointing at services no one holds | every reading | A | T1584.001 |
| Archived copies of the site | every reading | A | T1593 |
| Names made from the firm's: typos, endings, letters, word order, money and sector words | every reading | A | T1583.001 |
| Sign-in and help-desk words added to the firm's name | every reading | A | T1583.001 |
| Look-alike names seen in certificate logs | every reading | A | T1596.003 |
| Whether a look-alike takes mail | every reading | A | T1583.001 |
| When a look-alike was registered | every reading | A | T1596.002 |
| Whether a look-alike copies the firm's site | every reading | B | T1656 |
| Host names of a look-alike | every reading | A | T1590.002 |
| A look-alike's own mail records and blocklists | every reading | A | T1590.002 |
| Breach records by domain | every reading | B | T1589.001 |
| Breach records by address pattern | every reading | B | T1589.002 |
| Paste and leak sites | every reading | B | T1593 |
| Search-engine queries about the firm | every reading | B | T1593.002 |
| Phishing lists | every reading | B | T1596.005 |
| Malware address lists | every reading | A | T1596.005 |
| Court and insolvency records | every reading | A | none fits |
| The firm's other domains | every reading | A | T1590.002 |
The AI-answer check is built to ask these assistants about the firm. Each is asked through its vendor's own developer interface.
| Assistant | State |
|---|---|
| an AI assistant (Claude, with web search) | Asked today |
| ChatGPT search (OpenAI API, with web search) | Asked today |
| Gemini (with Google Search grounding) | Asked today |
| Perplexity | Asked today |
| Copilot, through Bing | Asked today |
| Grok (xAI API, with web search) | Asked today |
Public sources, named by kind.
Every finding comes from a source of one of these kinds and carries the evidence it came from. We read what anyone could read about your firm externally and nothing that needs a key.
The band says what is open. The number orders firms inside it.
The rating describes what can be read from beyond your firm's walls. It says nothing about what is inside: devices, backups, staff sign-in settings or training.
Most firms are High for one reason: 3 in 4 professional firms in the LeakTrace index publish no rule that stops email forged in their name (LeakTrace index, readings to 8 October 2026) and that is a way in that is open. The index
What counts
A way in that is open: something an outsider can use today to send email as the firm, sign in as staff, or reach an exposed system or file. One open way in puts a firm in the High band.
A way in that is partly closed: it is there and something still stands in the way or we could not confirm it.
These are counted this way:
- a forged-email rule set to quarantine
- a mail, web, file-transfer or remote-login port that answers with nothing else known
- software matched to published weaknesses by its version
- a look-alike domain that is registered or parked
It scores half and cannot put a firm in High.
Firm addresses listed in breach data are a way in that is open, whether or not we know that passwords were in the listing. This is our judgement and not a rule taken from a standard.
The reason is how such lists are used:
- a password leaked from one site is tried on the same person's accounts at other sites
- externally we cannot see that every listed password has been changed
We never say a listed password still works.
A look-alike of your domain that is set up for email is a way in that is open. So is one that is set up for email and also shows a copy of your website. This is our judgement and not a rule taken from a standard.
The reason is what such a set-up is for: a reply that looks like it came from your firm, with a page that makes a client's check look right.
A look-alike with a website and no mail stays partly closed.
How much breach data scores depends on what we know:
- that firm addresses are listed
- whether there is more than one
- whether passwords were in the listed data
- whether that listing is from the last two years
A listing with recent passwords scores above one where nothing is known about passwords.
How much breach data scores depends on what we know: that firm addresses are listed, whether there is more than one, whether passwords were in the listed data and whether that listing is from the last two years. A listing with recent passwords scores above one where nothing is known about passwords.
A setting to tidy adds one point. Beside a way in, all of a site's settings together add no more than one way in to a system does. They can never move a firm into the High band.
What does not count
Notes: website software we detected, a shared hosting address, a public record.
A check that did not answer. It can neither raise nor lower the rating and the rating says how many checks answered.
A finding with no evidence stored beside it.
How much damage a software flaw could do. We hold no impact data and no severity number for individual flaws.
A flaw on the public list of flaws known to be exploited counts as open only for server software we can see answering on your own host.
It never counts for a script library in a page and never on a shared host without that evidence.
Findings from the deeper page read on a paid assessment or monitoring. They are listed and counted on your pages, but do not change the rating, so buying from us can never move a firm's number.
Customer status. Every firm is rated by the same rules from what can be read externally.
The arithmetic
The band is decided first, from what was found. The number only orders firms inside the band.
The floors of the bands (80, 60 and 35) are there only so the word and the number agree. They measure nothing.
Each way in scores exploitation (1 no published technique, 2 a published technique, 3 known to be exploited or abuse listed on your own domain) multiplied by impact (1 partial, 2 a system or its files).
A way in that is partly closed or not confirmed scores half, rounded up.
Breach data is a way in that is open and scores 1 to 4: 1 for addresses listed, plus 1 for more than one address, plus 1 if passwords were in the listed data, plus 1 if that listing is from the last two years.
Critical: 80, plus the ways in (at most 16), plus one per setting to tidy (at most 4).
High: 60, plus the ways in (at most 15), plus one per setting to tidy (at most 4).
Moderate: 35, plus the ways in that are partly closed (at most 20), plus one per setting to tidy (at most 4, or at most 24 where nothing is partly closed).
Low: one per setting to tidy and no more than four of them. Four is our judgement of "a few".
How to tell us it is wrong
Email [email protected] from an address at your domain, or reply to the email that brought you your reading. Say which finding, or which part of the rating, is wrong.
We check it against the evidence stored with the reading. What is wrong we correct or delete and the rating is worked out again from what remains.
We tell you what we changed. You do not need to be a customer.
Where a number in the method is our own judgement and not taken from a standard, the method says so.
When the method changes, this page says what changed and for a month a customer's dashboard shows the rating under the old method beside the new one.
What the rating is built on
The rating uses the public sources below. None of their publishers has reviewed it.
| Source | What the rating uses it for |
|---|---|
| ATT&CK for EnterpriseMITRE · v19.2 (v19 released 28 April 2026; v19.2 dated 6 August 2026) | What each way in lets an attacker do. A finding is mapped to a technique only where the published description covers it. |
| Stakeholder-Specific Vulnerability Categorization GuideCISA, with CERT/CC at Carnegie Mellon University · CISA guide, November 2022; CERT/CC documentation release v2026.7.0 | The questions asked of each way in: is it being exploited, is it open to the internet and how much does it give an attacker. |
| Known Exploited Vulnerabilities CatalogCISA · catalogue version 2026.10.08 at fetch (1,739 entries) | The one test that puts a software flaw in the Critical band: it is on this list of flaws known to be exploited. |
| Binding Operational Directive 26-04: Prioritizing Security Updates Based on RiskCISA · 10 June 2026 | Ranking a flaw by whether it is publicly exposed, known to be exploited and how much control it gives, not by a severity number. |
| Common Vulnerability Scoring System version 4.0: User GuideFIRST · document version 1.2, 18 June 2024 | Why the rating does not use a flaw’s severity number: we do not hold one for the software we read and its publisher says it measures severity, not risk. |
| SP 800-30 Rev. 1, Guide for Conducting Risk AssessmentsNIST · Revision 1, September 2012 | The shape of the arithmetic: how likely a way in is to be used, combined with what it would give. |
| RFC 9989, Domain-Based Message Authentication, Reporting, and Conformance (DMARC)IETF · May 2026, Standards Track; obsoletes RFC 7489 | What each email protection setting asks a receiving mail server to do and where enforcement starts. |
| RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)IETF (Independent Submission) · March 2015, Informational; obsoleted by RFC 9989 | Reading an older email protection record that applies its rule to only part of the mail. |
| RFC 7208, Sender Policy Framework (SPF)IETF · April 2014, Standards Track | What the ending of an approved-senders record means. |
| Binding Operational Directive 18-01: Enhance Email and Web SecurityCISA · 16 October 2017 | The target for email protection: a policy that refuses forged mail. |
| Cybersecurity Performance Goals 2.0CISA · CPG 2.0 | The same email target, in a baseline written for organisations of every size. |
| Implementation guidance: email domain protection (ITSP.40.065 v1.1)Canadian Centre for Cyber Security · v1.1, in effect 12 August 2021 | The same email target, from the Canadian government. |
| Email security and anti-spoofingUK National Cyber Security Centre · Version 2.0, 7 October 2019 | The same email target, from the UK government. |
| Internet Exposure Reduction GuidanceCISA · revised 21 August 2026 | Why a service that answers the internet counts as partly closed unless it is one named as high-risk. |
| Weak Security Controls and Practices Routinely Exploited for Initial Access (AA22-137A)CISA with the cyber security authorities of Canada, New Zealand, the Netherlands and the United Kingdom · last revised 8 December 2022 | Which services reachable from the internet count as fully open: remote desktop, file sharing and Telnet. |
| SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator ManagementNIST · Revision 4, July 2025 | Why firm addresses listed in breach data count as a way in that is open: a password leaked from one site is tried on others. The standard describes the attack; counting a listing as open is our judgement. We never assume a listed password still works. |
| Content Security Policy Level 2W3C · W3C Recommendation, 15 December 2016 | Why a missing browser protection is a setting to tidy and not a way in. |
| Principles for Fair and Accurate Security RatingsUS Chamber of Commerce · June 2017 | How a rating should be run: the method published, a way to dispute it, opinion labelled as opinion, notice before the method changes. This one is a trade-association document, not a government standard. |
Method version 2, October 2026.
What changed from the earlier method: the band is now decided by what is open and not by adding up points for everything found, a way in that is partly closed can no longer put a firm in High and firm addresses listed in breach data count as a way in that is open.
Every paid assessment is held for human verification.
Every paid assessment is human-verified before it is released. Nothing releases on its own.
After the checks finish, a language model reviews what they recorded. It looks for findings that combine into a way in.
It adds no fact of its own:
- every item must cite findings the checks made or text copied from a public page
- each item is human-verified before a client sees it
On a paid assessment, our AI agents work your firm externally, stage by stage. Every paid assessment is human-verified before release. No AI agent can state a finding without a fixed external check behind it.
If the AI fails or reaches its limit, the fixed path runs as it did before.
What each AI agent does and what it can never do.
On a paid assessment, the Discover AI agent reads what your firm shows the public internet with fixed external checks: your email records, your website, your host names, look-alike domains and firm addresses in monitored breach databases.
It records each finding with the evidence it relied on and the date it was read.
It then chooses follow-up checks: which to run on what the first read listed, in what order and when to stop. The result of each check is what is stored.
The AI writes no finding.
Every finding is kept with the record that proves it and a check you can run yourself. A finding with no evidence is not released.
Then a person reads the assessment: every paid assessment is human-verified before release.
On a paid assessment, the Close AI agent gives you the fix for each finding, step by step.
For a fix to your own email records, where we hold a guide for your DNS host, it sets the steps out with that host's own screens.
Every line in those steps is written by us and AI chooses only where each one goes.
When you mark a fix done, AI chooses whether to re-check now or wait for the change to show externally.
The finding is recorded closed only when a fresh read externally shows it, with the date and the evidence.
On monitoring, fixed checks re-check your email settings, look-alike domains and new host names every hour and everything else in full every day.
When they find a change, the Monitor AI agent puts first the change that needs you, adds a plain reason when it has one and says when a new look-alike domain is worth a takedown request.
It cannot change a severity and cannot hold back a High or Critical change. You are alerted when something changes.
Your assessment comes with your AI security agent, on your dashboard.
- Ask it a question in plain English and it answers from your own firm's findings and names the finding it used.
- It drafts a note about any finding, for you to send.
- It proposes a re-check and runs it only when you approve.
- Your dashboard shows what our AI agents checked without being asked and tells you when a re-check finds an opening closed.
- When it cannot answer, a person replies.
Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. They change nothing by themselves: you approve each change to your email records.
What an assessment is not.
Scores reflect the state at the time of reading. They change as new breaches are disclosed and as infrastructure changes. No passwords, hashes or full email addresses are exposed in the documents.