The Cyphers Score¶
Every scanned endpoint gets a score from 0 to 100: start at 100, subtract a fixed deduction per security finding, floor at 0. No weights to tune, no proprietary curve — the same finding always costs the same, so a score is comparable across endpoints and across time, and a score change always traces to a named finding appearing or clearing.
What the score means¶
The score is what the internet sees. When an endpoint has been scanned from both vantages — the Scout on the box (internal) and a probe from outside (external) — the external score is the one displayed, even when the internal scan is fresher. That is a definition, not a tie-break: the score answers "how does this endpoint present to a connecting client", and a CDN or proxy in front of the box can make that answer differ from what the box itself serves. The internal vantage still matters — it drives installed-vs-served comparisons and delivery verification — it just doesn't define the score when an external observation exists.
The findings and their costs¶
Findings come from two layers. The Scout derives protocol-level findings during the scan; the Hub enriches them with certificate- and chain-level findings computed from the raw facts the Scout shipped. The arithmetic is all Hub-side.
| Finding | Deduction |
|---|---|
| TLS 1.0 enabled | −25 |
| TLS 1.1 enabled | −25 |
| BEAST (TLS 1.0 + CBC cipher) | −25 |
| TLS 1.3 missing | −10 |
| HSTS missing | −10 |
HSTS max-age under a year |
−5 |
| Certificate expired | −25 |
| Certificate expiring < 30 days | −10 |
| Certificate expiring < 7 days | −25 (replaces the 30-day finding) |
| OCSP stapling missing, or staple not good + fresh | −5 |
| Certificate revoked (per stapled OCSP) | forces 0 |
| Certificate name mismatch | forces 0 |
| RSA key < 2048 bits | −25 |
| ECDSA key < 256 bits | −15 |
| SHA-1 signature | −25 |
| MD5 signature | −25 |
| Weak cipher — RC4 / DES / NULL / EXPORT / anonymous | −25 |
| Weak cipher — 3DES | −15 |
| No forward secrecy (TLS 1.0–1.2) | −15 |
| Intermediate certificate expired | −25 |
| Chain order wrong | −5 |
| Self-signed (informational) | 0 |
| Chain incomplete (informational) | 0 |
The zero-deduction findings are deliberate: self-signed is a fact worth showing that is not by itself a defect (an internal endpoint on your own CA is fine), and an incomplete chain is surfaced for diagnosis without being double-charged on top of the trust errors it usually causes.
Tiers¶
| Score | Tier | |
|---|---|---|
| 95–100 | Exceptional | CYP verification code issued |
| 85–94 | Strong | CYP verification code issued |
| 70–84 | Adequate | |
| 50–69 | Weak | |
| 0–49 | Failing |
CYP codes are short verification codes (CYP-XXXXXX) minted only for
scores of 85 and above — an HMAC over the endpoint and date, so a code proves
"this endpoint scored Strong-or-better on this day" without exposing anything
else. They rotate daily.
Reading a score honestly¶
- A score describes one endpoint's served posture at scan time — it is not a fleet grade and not a certificate grade. The Manage page's group header summarises worst-of across a certificate's endpoints precisely so a good sibling can't mask a bad one.
- The deductions for TLS 1.0/1.1 are only measurable because the Scout can still complete those handshakes — see Scout → Scanning for how the findings are derived and which are Scout-side versus Hub-side.
- A stale observation caps what any score can claim: if no Scout has looked in 30 days, the row says so rather than presenting an old score as current — see Endpoints, proof, and management.