Methodology.
The method behind the outside record of trust: exactly what we read, and the check behind every finding. How an External Cybersecurity Assessment is done, written so an insurer, a lawyer or a regulator can quote it.
Attackers now use AI to read a firm from outside the way a search engine does: the website, directories, search results and what AI assistants say. We read it first, and every finding is human-verified before your assessment is released.
In 2025 the FBI recorded $3,046,598,558 in reported losses to business email compromise in the United States. FBI IC3, 2025 Internet Crime Report.
Read-only, from outside.
Every signal comes from a public source, and every finding carries the command or public source that proves it, so anyone can re-run it. Nothing is logged into. No penetration test is performed.
Five groups, each finding with its evidence.
dig TXT _dmarc.yourfirm.com returns the same record for anyone.The full list of categories, as the assessment documents name them
Public sources, named by kind.
Every finding comes from a source of one of these kinds, and carries the evidence it came from. We read what anyone could read about your firm from outside, and nothing that needs a key.
The band says what is open. The number orders firms inside it.
The rating describes what can be read from outside your firm. It says nothing about what is inside: devices, backups, staff sign-in settings or training.
Most firms are High for one reason: 3 in 4 professional firms in the LeakTrace index publish no rule that stops email forged in their name (LeakTrace index, readings to 8 October 2026), and that is a way in that is open. The index
What counts
A way in that is open: something an outsider can use today to send email as the firm, sign in as staff, or reach an exposed system or file. One open way in puts a firm in the High band.
A way in that is partly closed: it is there, and something still stands in the way or we could not confirm it.
These are counted this way:
- a forged-email rule set to quarantine
- a mail, web, file-transfer or remote-login port that answers with nothing else known
- software matched to published weaknesses by its version
- a look-alike domain that is registered or parked
It scores half and cannot put a firm in High.
Firm addresses listed in breach data are a way in that is open, whether or not we know that passwords were in the listing. This is our judgement and not a rule taken from a standard.
The reason is how such lists are used:
- a password leaked from one site is tried on the same person's accounts at other sites
- from outside we cannot see that every listed password has been changed
We never say a listed password still works.
Related items count once. Every email record that lets mail be forged in your name is one way in. Several answering services on one server are one way in.
How much breach data scores depends on what we know:
- that firm addresses are listed
- whether there is more than one
- whether passwords were in the listed data
- whether that listing is from the last two years
A listing with recent passwords scores above one where nothing is known about passwords.
A setting to tidy adds one point. Beside a way in, all of a site's settings together add no more than one way in to a system does. They can never move a firm into the High band.
What does not count
Notes: website software we detected, a shared hosting address, a public record.
A check that did not answer. It can neither raise nor lower the rating, and the rating says how many checks answered.
A finding with no evidence stored beside it.
How much damage a software flaw could do. We hold no impact data and no severity number for individual flaws.
A flaw on the public list of flaws known to be exploited counts as open only for server software we can see answering on your own host.
It never counts for a script library in a page, and never on a shared host without that evidence.
Whether you are a customer. Every firm is rated by the same rules from what can be read from outside.
The arithmetic
The band is decided first, from what was found. The number only orders firms inside the band.
The floors of the bands (80, 60 and 35) are there only so the word and the number agree. They measure nothing.
Each way in scores exploitation (1 no published technique, 2 a published technique, 3 known to be exploited or abuse listed on your own domain) multiplied by impact (1 partial, 2 a system or its files).
A way in that is partly closed or not confirmed scores half, rounded up.
Breach data is a way in that is open and scores 1 to 4: 1 for addresses listed, plus 1 for more than one address, plus 1 if passwords were in the listed data, plus 1 if that listing is from the last two years.
Critical: 80, plus the ways in (at most 16), plus one per setting to tidy (at most 4).
High: 60, plus the ways in (at most 15), plus one per setting to tidy (at most 4).
Moderate: 35, plus the ways in that are partly closed (at most 20), plus one per setting to tidy (at most 4, or at most 24 where nothing is partly closed).
Low: one per setting to tidy, and no more than four of them. Four is our judgement of "a few".
How to tell us it is wrong
Email [email protected] from an address at your domain, or reply to the email that brought you your reading. Say which finding, or which part of the rating, is wrong.
We check it against the evidence stored with the reading. What is wrong we correct or delete, and the rating is worked out again from what remains.
We tell you what we changed. You do not need to be a customer.
Where a number in the method is our own judgement and not taken from a standard, the method says so.
When the method changes, this page says what changed, and for a month a customer's dashboard shows the rating under the old method beside the new one.
What the rating is built on
The rating uses the public sources below. None of their publishers has reviewed it.
| Source | What the rating uses it for |
|---|---|
| ATT&CK for EnterpriseMITRE · v19.2 (v19 released 28 April 2026; v19.2 dated 6 August 2026) | What each way in lets an attacker do. A finding is mapped to a technique only where the published description covers it. |
| Stakeholder-Specific Vulnerability Categorization GuideCISA, with CERT/CC at Carnegie Mellon University · CISA guide, November 2022; CERT/CC documentation release v2026.7.0 | The questions asked of each way in: is it being exploited, is it open to the internet, and how much does it give an attacker. |
| Known Exploited Vulnerabilities CatalogCISA · catalogue version 2026.10.08 at fetch (1,739 entries) | The one test that puts a software flaw in the Critical band: it is on this list of flaws known to be exploited. |
| Binding Operational Directive 26-04: Prioritizing Security Updates Based on RiskCISA · 10 June 2026 | Ranking a flaw by whether it is publicly exposed, known to be exploited and how much control it gives, not by a severity number. |
| Common Vulnerability Scoring System version 4.0: User GuideFIRST · document version 1.2, 18 June 2024 | Why the rating does not use a flaw’s severity number: we do not hold one for the software we read, and its publisher says it measures severity, not risk. |
| SP 800-30 Rev. 1, Guide for Conducting Risk AssessmentsNIST · Revision 1, September 2012 | The shape of the arithmetic: how likely a way in is to be used, combined with what it would give. |
| RFC 9989, Domain-Based Message Authentication, Reporting, and Conformance (DMARC)IETF · May 2026, Standards Track; obsoletes RFC 7489 | What each email protection setting asks a receiving mail server to do, and where enforcement starts. |
| RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)IETF (Independent Submission) · March 2015, Informational; obsoleted by RFC 9989 | Reading an older email protection record that applies its rule to only part of the mail. |
| RFC 7208, Sender Policy Framework (SPF)IETF · April 2014, Standards Track | What the ending of an approved-senders record means. |
| Binding Operational Directive 18-01: Enhance Email and Web SecurityCISA · 16 October 2017 | The target for email protection: a policy that refuses forged mail. |
| Cybersecurity Performance Goals 2.0CISA · CPG 2.0 | The same email target, in a baseline written for organisations of every size. |
| Implementation guidance: email domain protection (ITSP.40.065 v1.1)Canadian Centre for Cyber Security · v1.1, in effect 12 August 2021 | The same email target, from the Canadian government. |
| Email security and anti-spoofingUK National Cyber Security Centre · Version 2.0, 7 October 2019 | The same email target, from the UK government. |
| Internet Exposure Reduction GuidanceCISA · revised 21 August 2026 | Why a service that answers the internet counts as partly closed unless it is one named as high-risk. |
| Weak Security Controls and Practices Routinely Exploited for Initial Access (AA22-137A)CISA with the cyber security authorities of Canada, New Zealand, the Netherlands and the United Kingdom · last revised 8 December 2022 | Which services reachable from the internet count as fully open: remote desktop, file sharing and Telnet. |
| SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator ManagementNIST · Revision 4, July 2025 | Why firm addresses listed in breach data count as a way in that is open: a password leaked from one site is tried on others. The standard describes the attack; counting a listing as open is our judgement. We never assume a listed password still works. |
| Content Security Policy Level 2W3C · W3C Recommendation, 15 December 2016 | Why a missing browser protection is a setting to tidy and not a way in. |
| Principles for Fair and Accurate Security RatingsUS Chamber of Commerce · June 2017 | How a rating should be run: the method published, a way to dispute it, opinion labelled as opinion, notice before the method changes. This one is a trade-association document, not a government standard. |
Method version 2, October 2026.
What changed from the earlier method: the band is now decided by what is open and not by adding up points for everything found, a way in that is partly closed can no longer put a firm in High, and firm addresses listed in breach data count as a way in that is open.
Every paid assessment is held for human verification.
Every paid assessment is human-verified before it is released. Nothing releases on its own.
After the checks finish, a language model reviews what they recorded. It looks for findings that combine into a way in.
It adds no fact of its own:
- every item must cite findings the checks made or text copied from a public page
- each item is human-verified before a client sees it
On a paid assessment, our AI agents work your firm from outside, stage by stage, and it is human-verified before release. No AI agent can state a finding without a fixed outside check behind it.
If the AI fails or reaches its limit, the fixed path runs as it did before.
What each AI agent does, and what it can never do.
On a paid assessment, the Discover AI agent reads what your firm shows the public internet with fixed outside checks: your email records, your website, your host names, look-alike domains, and firm addresses in monitored breach databases.
It records each finding with the evidence it relied on and the date it was read.
It then chooses follow-up checks: which to run on what the first read listed, in what order, and when to stop. The result of each check is what is stored.
The AI writes no finding.
Every finding is kept with the record that proves it and a check you can run yourself. A finding with no evidence is not released.
Then a person reads the assessment: every paid assessment is human-verified before release.
On a paid assessment, the Close AI agent gives you the fix for each finding, step by step.
For a fix to your own email records, where we hold a guide for your DNS host, it sets the steps out with that host's own screens.
Every line in those steps is written by us, and AI chooses only where each one goes.
When you mark a fix done, AI chooses whether to re-check now or wait for the change to show from outside.
The finding is recorded closed only when a fresh read from outside shows it, with the date and the evidence.
On monitoring, fixed checks re-check your email settings, look-alike domains and new host names every hour, and everything else in full every day.
When they find a change, the Monitor AI agent puts first the change that needs you, adds a plain reason when it has one, and says when a new look-alike domain is worth a takedown request.
It cannot change a severity and cannot hold back a High or Critical change. You are alerted when something changes.
Your assessment comes with your AI security agent, on your dashboard.
- Ask it a question in plain English and it answers from your own firm's findings, and names the finding it used.
- It drafts a note about any finding, for you to send.
- It proposes a re-check and runs it only when you approve.
- Your dashboard shows what our AI agents checked without being asked, and tells you when a re-check finds an opening closed.
- When it cannot answer, a person replies.
Our AI agents work from outside only. They never log in, never install anything, and never touch your internal systems.
The one change they can make, to your email records, happens only when you approve it.
What an assessment is not.
Scores reflect the state at the time of reading. They change as new breaches are disclosed and as infrastructure changes. No passwords, hashes or full email addresses are exposed in the documents.