What TrustSek checks
Every scan reads a domain's public evidence in six modules. Each module has a fixed, published weight, and each page lists every finding it can raise and how to fix it.
Last reviewed
The modules cover what an outsider can see without access: how mail is authenticated, how the website is encrypted and configured, whether public software has known vulnerabilities, what is exposed, whether the domain appears on threat lists, and whether the organisation is named on a ransomware leak site. The methodology explains how their findings combine into one score.
Email security
SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC and nameserver redundancy.
20% of the score
TLS and web hygiene
Whether HTTPS is served, certificates, protocol versions and ciphers, redirects, security headers and cookie flags.
20% of the score
Ransomware exposure
Claims naming the organisation on ransomware leak sites, from two independent trackers.
20% of the score
Reputation
The domain and its addresses on threat-intel, malware, phishing and botnet lists.
15% of the score
Vulnerabilities
Advertised software versions matched against known-exploited and published vulnerabilities.
15% of the score
Attack surface
Subdomains, high-risk hostnames, open non-web ports, domain age and lookalike domains.
10% of the score