Deep Dive Into Scoring: the Sections
This reference explains what each section of the score looks at, what "Not measured" means for it, and where to fix issues. Section names are exactly as shown in the product.
Core sections (both scores)
DNS & email security (15). Can someone send mail as you, and is your DNS zone hardened? Typical issues: missing or weak sender authentication and policy, an unhardened zone.
Network exposure (15). Services reachable from the internet that should not be. Findings on a shared network edge (see below) do not deduct.
Known vulnerabilities (15). Published vulnerabilities on the services you expose. Known-exploited vulnerabilities count as critical. Findings on a shared network edge do not deduct.
TLS & certificates (10). Is traffic to you encrypted with a valid certificate and a modern protocol?
Web security headers (10). Browser protections your websites send, and whether you publish a security contact.
Patching cadence (10). Software versions on your surface that have known vulnerabilities.
Breach history (10). Public breaches of services on your domain. Each decays over three years, so an old breach costs less each year. Standard scorecards show counts and dates only.
Leaked credentials (5). Credentials for your domain in leak collections and stealer logs. On a standard rating, counts and dates are shown and any email address is masked as "an address at
IP reputation (5). Whether your mail and web addresses are on spam or abuse blocklists.
Lookalike domains (5). Registered look-alikes of your domain that can receive mail or serve a site.
Shared network edge
Findings in Network exposure and Known vulnerabilities that sit on an address in a listed set of content-delivery and large cloud-provider networks are recorded as context and do not deduct: the address is the provider's shared edge, not necessarily your host. They appear in Issues as Not counted.
Module sections (security score only)
Available only when the module is in your plan. Otherwise the section shows "Not in your plan" and is left out of the score.
- Brand Protection: Brand threats (10; impersonation of your brand: phishing sites, scams, fake apps and profiles), Data exposure (5; your data where it should not be: open buckets, code, archives and pastes), Takedown effectiveness (5; how much of what you asked to take down actually came down, in percent).
- Human Risk: Phishing susceptibility (10; how your people respond to simulated phishing), Training completion (5; share of assigned security training completed).
- Compliance: Control coverage (10; share of your framework controls implemented), Evidence freshness (5; share of control evidence that is current).
What "Not measured" means, per case
- "No check for this section has run yet": the run that produced the rating did not include the check. Run the Outside-in rating or a broader preset.
- "Its check failed in the latest run": the check could not complete. This is not a clean result. Re-run.
- "No data for this measure yet": a metric section has nothing to read.
Which lookups count towards the standard rating
Only passive, outside-in checks: email and zone posture, TLS handshake, IP reputation, breach history, lookalike domains, domain age, leak and credential exposure checks, certificate intelligence, passive exposure, web surface posture, IP discovery, exposed service posture, technology vulnerabilities and host profile. Active scans count toward the security score only.
Fixing issues
From the Issues tab, the fix button opens the surface where the issue is worked: core sections open Exposures filtered to that section ("Open in Exposures"); Brand Protection issues open Brand Protection ("Open in Brand Protection").
Use cases and wiring tips
- Pair each section with an owner: email with the messaging team, TLS and headers with web engineering, breaches and leaks with identity.
- If Lookalike domains or Leaked credentials look suspiciously clean, check that the section is measured (see Nothing found is not the same as we could not look).