Grading methodology
The rubric is published in full. Every grade we issue lists the exact rules that produced it, so a grade can always be argued with on the merits. Current rubric version: 1.0.0.
Key exchange dominates, by design
Key exchange carries 60% of the score. It is the only axis where traffic recorded today is retroactively decryptable: an attacker who captures a session now can decrypt it later, once a cryptographically relevant quantum computer exists. Nothing else on the scorecard has that property.
| Category | Weight | Why |
|---|---|---|
| Key exchange | 60% | Retroactively decryptable: the harvest-now-decrypt-later axis |
| Protocol versions | 15% | TLS 1.3 is a prerequisite for hybrid post-quantum key exchange |
| Cipher suites | 15% | Classical hygiene: forward secrecy, RC4, 3DES, CBC modes |
| Certificate | 10% | Validity and trust, plus a reported signature algorithm |
Why certificate signatures are weighted gently
Certificate signatures are quantum-vulnerable too, and we report them. But unlike a recorded key exchange, a signature cannot be forged retroactively: an attacker needs the quantum computer while the certificate is still valid, and certificates rotate every 90 days or so. Treating both risks as equally urgent would misdirect remediation effort.
Caps are ceilings, not floors
Some findings cap a grade regardless of how good everything else is. An invalid, expired, or untrusted certificate caps at F, as does SSLv3 or an accepted RC4 or 3DES suite. A host with no forward secrecy caps at D. A host without TLS 1.3 caps at C, because it cannot negotiate post-quantum key exchange at all without a protocol upgrade.
A cap can only ever lower a grade. A host already scoring below a cap keeps its worse grade.
Calibration
A host with TLS 1.3, strong suites, and a valid certificate, whose only gap is classical key exchange, lands at C: adequate today, not future-proof. That describes most of the internet, and grading it F would flatten the scale and read as fearmongering. Urgency is carried by the harvest-now-decrypt-later flag and the headline, which appear regardless of letter.
The domain grade is the worst host
An estate is only as protected as its weakest internet-facing endpoint. Averaging would let a large, mostly-healthy estate hide a critical exposure, so the domain grade is the worst grade among reachable hosts.
Grades are versioned
Every grade is stamped with the rubric version that produced it. When guidance moves and we recalibrate, historical scans are re-scored under the new version while the previous grades are retained. That way we can always show you that your grade changed because our rubric moved, not because your infrastructure did.