Public-signal posture score · methodology v4.0
F5 Cyber calculates its own score from passive, publicly published evidence. It does not import a SecurityScorecard or Bitsight rating. To stay clear of legal risk, we only use public DNS lookups, one ordinary visit to the vendor’s homepage and its /.well-known/security.txt file, public Certificate Transparency logs, public phishing and malware feeds, and the public CISA Known Exploited Vulnerabilities catalog. Sources were chosen from the OSINT Framework catalog, keeping only those that are free, passive and allow automated use. We do not port-scan, probe for vulnerabilities, query paid scanning databases, or use breach dumps, leaked credentials or ransomware leak sites. The weights below are product choices for prioritizing review; they are not an industry standard or a validated prediction of a breach.
Score / 100 = Email 30 + DNS 12 + Web 23 + Disclosure 5 + Exploited vulnerabilities 15 + Reputation 10 + Certificates 5
We add the awarded points directly. There is no vendor-size adjustment or ranking against other companies. One override applies: if the vendor’s homepage itself is currently listed for phishing or malware, the total is capped at 49 (red), whatever the other checks earn.
Points awarded for each observed signal| Check | Public evidence | Calculation |
|---|
SPF
Up to 9 | TXT records at the listed domain, following SPF redirects. | -all: 9. ~all: 6. Other single policy: 2. None or multiple: 0. |
|---|
DMARC
Up to 17 | TXT at _dmarc.domain, falling back to the organizational domain’s sp/p. | p=reject: 17. quarantine: 11. none: 4. Multiplied by pct. |
|---|
MTA-STS / TLS-RPT
Up to 4 | TXT at _mta-sts.domain and _smtp._tls.domain. | MTA-STS published: 2. TLS-RPT published: 2. |
|---|
DNSSEC
Up to 6 | The resolver’s authenticated-data (AD) flag. | AD=true: 6. Otherwise 0. |
|---|
CAA
Up to 6 | CAA records at the exact domain. | An issue/issuewild tag: 6. |
|---|
HTTPS
Up to 8 | One normal request to https://domain/. | Valid certificate and a response: 8. No valid HTTPS response: 0. |
|---|
HTTP→HTTPS
Up to 4 | One request to http://domain/ without following redirects. | Redirects to HTTPS, or plain HTTP not served: 4. Serves plain HTTP: 0. |
|---|
HSTS
Up to 6 | Strict-Transport-Security on the HTTPS response. | max-age ≥ 1 year: 6. ≥ 180 days: 4. Shorter: 1. Absent: 0. |
|---|
Security headers
Up to 5 | Headers on the HTTPS response. | CSP 2, nosniff 1, clickjacking protection 1, Referrer-Policy 1. |
|---|
security.txt
Up to 5 | /.well-known/security.txt (RFC 9116), the file vendors publish for vulnerability reports. | Valid with Contact: 5. Expired: 3. Missing: 0. |
|---|
Known exploited vulnerabilities
Up to 15 | CISA KEV entries whose vendor matches the first word of the vendor name, added in the last 365 days. | Each entry is weighted by recency, e−days/180. Points = 15 × (1 − load ÷ 4), floored at 0. No recent entries: 15. |
|---|
Malicious-content reputation
Up to 10 | Currently listed URLs in URLhaus (malware) and the OpenPhish community feed (phishing), plus Google Safe Browsing when an API key is configured. Lists refresh hourly. | Nothing listed: 10. Listings only on subdomains: 5. Listings on pages or files of the primary domain: 3. Both can be compromised assets or files uploaded by customers of a platform (GitHub release downloads, for example). Homepage itself listed: 0, and the total is capped at 49. |
|---|
Certificate hygiene
Up to 5 | Currently valid certificates for the domain and its subdomains in public Certificate Transparency logs, via crt.sh, falling back to Cert Spotter. | No certificate valid for more than 398 days (the CA/Browser Forum limit): 3. Development, test or admin hostnames (such as dev, staging, jenkins, vpn) published in certificates: none 2, 1–5 1, more 0. |
|---|
Reading the colors
Green, 80–100: strong signals under this model. Amber, 50–79: review the findings. Red, 0–49: prioritize review. A red tile does not mean a domain is malicious or compromised. T1–T4 express your business priority and never change the security score.
Worked example
SPF ~all (6) + DMARC p=reject (17) + no MTA-STS/TLS-RPT (0) + DNSSEC (0) + CAA (6) + HTTPS (8) + redirect (4) + HSTS 1 year (6) + 3 of 4 headers (4) + no security.txt (0) + two KEV entries 60 days old (load 1.43 → 9) + clean reputation (10) + three staging hostnames in certificates (4) = 74 / 100, amber. If the same vendor’s homepage were listed on URLhaus, reputation would earn 0 and the total would be capped at 49.
Missing records versus unavailable evidence
A completed lookup with no applicable record earns zero for that check. A failed, timed-out, truncated, or otherwise unusable DNS lookup, or an unreachable KEV catalog or abuse feed, is unavailable. Certificate hygiene is supplementary: public certificate logs are often rate-limited or down, so when neither crt.sh nor Cert Spotter responds, that check shows as unavailable and the other 95 points are scaled to 100 instead of withholding the total. A homepage that gives no valid HTTPS response scores zero for the web checks, because an invalid certificate cannot be told apart from an outage. If any check is unavailable, the total is withheld and the tile stays gray. We do not convert an outage into zero or inflate the remaining checks to 100. SPF redirect loops, unsupported redirect names, and depth-limit failures also leave the assessment incomplete.
Sources and freshness
DNS evidence comes from Google Public DNS’s DNS-over-HTTPS service. Web evidence comes from one ordinary request each to the vendor’s homepage and security.txt, sent with a user agent that identifies F5 Cyber. Vulnerability evidence comes from the CISA KEV catalog. Certificate evidence comes from public Certificate Transparency logs. Reputation evidence comes from the URLhaus and OpenPhish public feeds. Open a vendor and expand each check to see the recorded finding and a link to the public source. Links return current data, which may differ from the saved observation.
The catalog opens with the compiled snapshot or a newer saved assessment. The “Checked” time identifies when its evidence was gathered. Refreshes reuse results less than one hour old; results older than 24 hours are flagged. Refresh a scorecard, or open “Assess my tiers” and choose “Refresh selected scores”, to request an assessment. All vendor scores and live intelligence feeds refresh daily around 12:05 a.m. America/New_York, including when the dashboard is closed.
What the number cannot tell you
This model deliberately excludes signals that need active scanning, paid or licensed data, or legally sensitive sources. That includes open ports and exposed services (Shodan, Censys and similar need a commercial license), active scanners, breach history, leaked credentials, infostealer logs, dark-web and leak sites, employee email harvesting, and commercial blocklists such as Spamhaus. It also cannot see internal controls, compliance, TLS protocol versions or DKIM. KEV matching uses the vendor’s name, so it can miss renamed product lines or match an unrelated vendor with the same first word. A vendor that ships no software always earns the full 15 KEV points. Abuse feeds only show what is listed right now, and a large platform (for example one that hosts customer sites or documents) can collect subdomain listings it did not cause. Certificate logs show names the vendor chose to publish, not what is reachable. A brand’s listed domain is only part of its infrastructure. Even 100 / 100 means only that these checks received full points at the observation time.