sana.de Security Score: 77 (Grade C)

Scanning external signals… this can take up to a couple of minutes.

Download PDF report

FairSRS Score - sana.de

77/100

FairSRS Score

Grade

Needs Improvement

Signal Rating

21 positive signals

7 risk signals

57 host(s), 93 subdomain(s)

Scan coverage. This report analyzed sana.de and all 93 discovered subdomains.

Category Breakdown

Categories with items of opportunity are clickable - open one to see the action items that would raise its score.

		87/100
		56/100
		81/100
Vulnerability Exposure		95/100
		57/100

8 items of opportunity in this category: 4 risk signals costing no points, and 3 strengths to extend to more hosts worth up to +7 points, and 1 unearned strength worth up to +4 points.

Risk signals found

TLS 1.0 Enabled0

Deprecated TLS 1.0 is still enabled

mail.sana.de 195.227.115.250 :443 + 1 other host · 2 of 50 SSL hosts (4%)

TLS Versions	TLSv1, -SSLv2, -SSLv3, TLSv1.1, TLSv1.2, -TLSv1.3
Adoption	2 of 50 SSL hosts (4%)

Observed on 2 hosts

action.sana.de
mail.sana.de

TLS 1.1 Enabled0

Deprecated TLS 1.1 is still enabled

mail.sana.de 195.227.115.250 :443 + 1 other host · 2 of 50 SSL hosts (4%)

TLS Versions	TLSv1, -SSLv2, -SSLv3, TLSv1.1, TLSv1.2, -TLSv1.3
Adoption	2 of 50 SSL hosts (4%)

Observed on 2 hosts

action.sana.de
mail.sana.de

Expired Certificate0

SSL/TLS certificate has expired

zukunftswerkstatt.sana.de 116.202.183.166 :443 · 1 of 50 SSL hosts (2%)

Certificate Issuer	DigiCert Inc
Subject	zukunftswerkstatt.sana.de
Expired	2021-09-22T12:00:00
Adoption	1 of 50 SSL hosts (2%)

Certificate Hostname Mismatch0

Domain not found in certificate Subject Alternative Names

mvz-mivb02.mitel.sana.de 62.27.3.3 :443 + 3 other hosts · 4 of 50 SSL hosts (8%)

Certificate CN	mvz-mbg01.mitel.sana.de
Certificate SANs	(none)
Expected Domain	mvz-mivb02.mitel.sana.de
Adoption	4 of 50 SSL hosts (8%)

Observed on 4 hosts

mvz-mbg02.mitel.sana.de
mvz-mivb01.mitel.sana.de
mvz-mivb02.mitel.sana.de
stakeholdersurvey.sana.de

Strengths to extend to more hosts

You already do these right on some hosts - rolling them out to the rest is the fastest way to raise this score. Points shown are the signal’s full value; the actual gain scales with how many hosts you cover.

PQC-Ready Infrastructure+4

Present on of 50 hosts (30%).

Missing on 35 hosts

50-jahre.sana.de
community.sana.de
dev-hr.sana.de
email.news.sana.de
extranet-portal.sana.de
ftp-fra.sana.de
hintbox.sana.de
img-mbg01.mitel.sana.de
img-micollab.mitel.sana.de
infocenter.sana.de
jobs.sana.de
login.sana.de
mail.sana.de
marke.sana.de
mvz-mbg01.mitel.sana.de
mvz-mbg02.mitel.sana.de
mvz-mivb01.mitel.sana.de
mysite.sana.de
oos.sana.de
preprod.sana.de
prod-community.sana.de
prod-projekte.sana.de
projekte.sana.de
sana.de
ssp-qa.sana.de
staging.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.sana.de

HSTS Enabled+2

Present on of 50 hosts (70%).

Missing on 15 hosts

action.sana.de
dev-hr.sana.de
email.news.sana.de
hr.sana.de
jobs.sana.de
mail.sana.de
preprod.sana.de
sana.de
ssp-qa.sana.de
staging.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-jobs.sana.de
www.stimmungsbarometer.sana.de
zukunftswerkstatt.sana.de

TLS 1.3 Supported+1

Present on of 50 hosts (90%).

Missing on 5 hosts

hintbox.sana.de
jobs.sana.de
login.sana.de
mail.sana.de
test-jobs.sana.de

Strengths not yet earned

Signals this category has on no host yet. Points are the signal’s full value - the effect on the overall score is weighted.

OCSP Stapling+4

4 items of opportunity in this category: 1 risk signal costing -8 points, and 1 strength to extend to more hosts worth up to +14 points, and 2 unearned strengths worth up to +12 points.

Risk signals found

High-Risk Port Open: FTP-8

Port 21 (FTP) is exposed to the internet

stakeholdersurvey.sana.de 185.243.133.167 :21

Port	21
Service	FTP
Host	185.243.133.167

Strengths to extend to more hosts

WAF/CDN Detected+14

Present on of 50 hosts (6%).

Missing on 47 hosts

50-jahre.sana.de
action.sana.de
community.sana.de
daten.sana.de
dev-hr.sana.de
dsms.sana.de
email.news.sana.de
extranet-portal.sana.de
ftp-fra.sana.de
hintbox.sana.de
hr.sana.de
img-mbg01.mitel.sana.de
img-mbg02.mitel.sana.de
img-micc.mitel.sana.de
img-micollab.mitel.sana.de
infocenter.sana.de
jobs.sana.de
karriere.sana.de
login.sana.de
mail.sana.de
mvz-mbg01.mitel.sana.de
mvz-mbg02.mitel.sana.de
mvz-micollab.mitel.sana.de
mvz-mivb01.mitel.sana.de
mvz-mivb02.mitel.sana.de
mysite.sana.de
oos.sana.de
prod-community.sana.de
prod-extranet-portal.sana.de
prod-projekte.sana.de
projekte.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.50-jahre.sana.de
www.sana.de
www.stimmungsbarometer.sana.de
zukunftswerkstatt.sana.de

Strengths not yet earned

Signals this category has on no host yet. Points are the signal’s full value - the effect on the overall score is weighted.

Standard Ports Only+7

Minimal Open Ports (≤3)+5

6 items of opportunity in this category: 1 risk signal costing no points, and 5 strengths to extend to more hosts worth up to +16 points.

Risk signals found

Server Version Disclosed0

Server header reveals software version information

karriere.sana.de 54.74.251.21 :80 · 1 of 50 HTTP hosts (2%)

Server Header	apache/2.4.58 (ubuntu)
Adoption	1 of 50 HTTP hosts (2%)

Strengths to extend to more hosts

Content Security Policy+7

Present on of 50 hosts (18%).

Missing on 41 hosts

action.sana.de
community.sana.de
daten.sana.de
dev-hr.sana.de
email.news.sana.de
extranet-portal.sana.de
hr.sana.de
img-mbg01.mitel.sana.de
img-mbg02.mitel.sana.de
img-micollab.mitel.sana.de
infocenter.sana.de
jobs.sana.de
karriere.sana.de
mail.sana.de
marke.sana.de
mvz-mbg01.mitel.sana.de
mvz-mbg02.mitel.sana.de
mvz-micollab.mitel.sana.de
mvz-mivb01.mitel.sana.de
mvz-mivb02.mitel.sana.de
mysite.sana.de
oos.sana.de
preprod.sana.de
prod-community.sana.de
prod-extranet-portal.sana.de
prod-projekte.sana.de
projekte.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
staging.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.stimmungsbarometer.sana.de

X-Frame-Options+3

Present on of 50 hosts (46%).

Missing on 27 hosts

action.sana.de
community.sana.de
dev-hr.sana.de
email.news.sana.de
extranet-portal.sana.de
hr.sana.de
infocenter.sana.de
jobs.sana.de
mail.sana.de
mysite.sana.de
oos.sana.de
prod-community.sana.de
prod-projekte.sana.de
projekte.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.stimmungsbarometer.sana.de

Permissions-Policy+3

Present on of 50 hosts (6%).

Missing on 47 hosts

action.sana.de
community.sana.de
daten.sana.de
dev-hr.sana.de
dsms.sana.de
email.news.sana.de
extranet-portal.sana.de
ftp-fra.sana.de
hr.sana.de
img-mbg01.mitel.sana.de
img-mbg02.mitel.sana.de
img-micc.mitel.sana.de
img-micollab.mitel.sana.de
infocenter.sana.de
jobs.sana.de
karriere.sana.de
login.sana.de
mail.sana.de
marke.sana.de
mvz-mbg01.mitel.sana.de
mvz-mbg02.mitel.sana.de
mvz-micollab.mitel.sana.de
mvz-mivb01.mitel.sana.de
mvz-mivb02.mitel.sana.de
mysite.sana.de
oos.sana.de
preprod.sana.de
prod-community.sana.de
prod-extranet-portal.sana.de
prod-projekte.sana.de
projekte.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
staging.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.sana.de
www.stimmungsbarometer.sana.de
zukunftswerkstatt.sana.de

Referrer-Policy+2

Present on of 50 hosts (40%).

Missing on 30 hosts

action.sana.de
community.sana.de
dev-hr.sana.de
email.news.sana.de
extranet-portal.sana.de
hr.sana.de
infocenter.sana.de
jobs.sana.de
karriere.sana.de
mail.sana.de
marke.sana.de
mysite.sana.de
oos.sana.de
prod-community.sana.de
prod-projekte.sana.de
projekte.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
stakeholdersurvey.sana.de
stimmungsbarometer.sana.de
test-community.sana.de
test-extranet-portal.sana.de
test-infocenter.sana.de
test-jobs.sana.de
test-mysite.sana.de
test-oos.sana.de
test-projekte.sana.de
www.stimmungsbarometer.sana.de
zukunftswerkstatt.sana.de

X-Content-Type-Options+1

Present on of 50 hosts (74%).

Missing on 13 hosts

action.sana.de
dev-hr.sana.de
hr.sana.de
jobs.sana.de
mail.sana.de
marke.sana.de
preprod.sana.de
qr.sana.de
sana.de
ssp-qa.sana.de
staging.sana.de
stakeholdersurvey.sana.de
test-jobs.sana.de

5 items of opportunity in this category: 1 risk signal costing -6 points, and 4 unearned strengths worth up to +35 points.

Risk signals found

SPF Soft Fail (~all)-6

SPF record uses soft fail (~all) instead of hard fail (-all) -- mail servers may still accept spoofed email

img-micc.mitel.sana.de 62.27.50.1

SPF Record	v=spf1 mx include:spf-00100501.pphosted.com ~all

Strengths not yet earned

Signals this category has on no host yet. Points are the signal’s full value - the effect on the overall score is weighted.

DMARC Reject Policy+15

DKIM Record Found+10

MTA-STS Present+5

Managed DNS Provider+5

Security Signals

Risk Signals (7)

Category	Signal	Points
Network Security	High-Risk Port Open: FTP Port 21 (FTP) is exposed to the internet stakeholdersurvey.sana.de 185.243.133.167 :21	-8
Email Security	SPF Soft Fail (~all) SPF record uses soft fail (~all) instead of hard fail (-all) -- mail servers may still accept spoofed email img-micc.mitel.sana.de 62.27.50.1	-6
TLS / Cryptography	TLS 1.0 Enabled Deprecated TLS 1.0 is still enabled mail.sana.de 195.227.115.250 :443 + 1 other host · 2 of 50 SSL hosts (4%)	0
TLS / Cryptography	TLS 1.1 Enabled Deprecated TLS 1.1 is still enabled mail.sana.de 195.227.115.250 :443 + 1 other host · 2 of 50 SSL hosts (4%)	0
TLS / Cryptography	Expired Certificate SSL/TLS certificate has expired zukunftswerkstatt.sana.de 116.202.183.166 :443 · 1 of 50 SSL hosts (2%)	0
TLS / Cryptography	Certificate Hostname Mismatch Domain not found in certificate Subject Alternative Names mvz-mivb02.mitel.sana.de 62.27.3.3 :443 + 3 other hosts · 4 of 50 SSL hosts (8%)	0
Application Hardening	Server Version Disclosed Server header reveals software version information karriere.sana.de 54.74.251.21 :80 · 1 of 50 HTTP hosts (2%)	0

Positive Signals (21)

Category	Signal	Points
TLS / Cryptography	TLS 1.3 Supported Server supports TLS 1.3 img-micc.mitel.sana.de 62.27.50.1 :443 + 44 other hosts · 45 of 50 SSL hosts (90%)	+9
TLS / Cryptography	Strong Ciphers Only Only strong cipher suites detected (ECDHE+AES-GCM/ChaCha20) img-micc.mitel.sana.de 62.27.50.1 :443	+8
TLS / Cryptography	Valid Certificate SSL/TLS certificate is valid and not expired img-micc.mitel.sana.de 62.27.50.1 :443 + 48 other hosts · 49 of 50 SSL hosts (98%)	+8
TLS / Cryptography	Reputable Certificate Authority Certificate issued by a reputable CA img-micc.mitel.sana.de 62.27.50.1 :443 + 49 other hosts · 50 of 50 SSL hosts (100%)	+5
TLS / Cryptography	HSTS Enabled HTTP Strict Transport Security header present img-micc.mitel.sana.de 62.27.50.1 :443 + 34 other hosts · 35 of 50 SSL hosts (70%)	+5
TLS / Cryptography	PQC-Ready Infrastructure Server supports TLS 1.3 with TLS_AES_256_GCM_SHA384 cipher suite, indicating readiness for post-quantum hybrid key exchange (X25519 + ML-KEM-768) img-micc.mitel.sana.de 62.27.50.1 :443 + 14 other hosts · 15 of 50 SSL hosts (30%)	+2
Network Security	WAF/CDN Detected Protected by Cloudflare staging.sana.de 104.18.40.184 + 2 other hosts · 3 of 50 HTTP hosts (6%)	+1
Network Security	Enterprise Cloud Hosting Hosted on AWS marke.sana.de 63.188.77.156	+8
Network Security	No Database Ports Exposed No database ports (MySQL, PostgreSQL, MongoDB, etc.) are exposed img-micc.mitel.sana.de 62.27.50.1	+5
Application Hardening	No Server Version Disclosure Server header does not reveal software version img-micc.mitel.sana.de 62.27.50.1 + 48 other hosts · 49 of 50 HTTP hosts (98%)	+10
Application Hardening	Content Security Policy CSP header is present login.sana.de 93.122.71.7 :443 + 8 other hosts · 9 of 50 HTTP hosts (18%)	+1
Application Hardening	X-Frame-Options Clickjacking protection header present img-micc.mitel.sana.de 62.27.50.1 :80 + 22 other hosts · 23 of 50 HTTP hosts (46%)	+2
Application Hardening	X-Content-Type-Options MIME type sniffing protection present img-micc.mitel.sana.de 62.27.50.1 :80 + 36 other hosts · 37 of 50 HTTP hosts (74%)	+4
Application Hardening	Referrer-Policy Referrer policy header present img-micc.mitel.sana.de 62.27.50.1 :80 + 19 other hosts · 20 of 50 HTTP hosts (40%)	+1
Application Hardening	Permissions-Policy Permissions policy header present www.50-jahre.sana.de 78.47.211.231 :443 + 2 other hosts · 3 of 50 HTTP hosts (6%)	+0
Application Hardening	No Default Pages No default/welcome pages detected img-micc.mitel.sana.de 62.27.50.1 + 49 other hosts · 50 of 50 HTTP hosts (100%)	+5
Application Hardening	No Admin Interfaces Exposed No exposed admin panels detected img-micc.mitel.sana.de 62.27.50.1	+8
Vulnerability Exposure	No Validated CVEs No validated vulnerabilities detected. 83 version-inferred CVEs observed but not validated, so excluded from the score. img-micc.mitel.sana.de 62.27.50.1	+30
Vulnerability Exposure	No Outdated Software Detected All detected software versions are within acceptable ranges img-micc.mitel.sana.de 62.27.50.1	+15
Email Security	DMARC Monitor-Only DMARC policy set to none (monitoring only) img-micc.mitel.sana.de 62.27.50.1	+3
Email Security	Enterprise Email Gateway Email protected by Proofpoint img-micc.mitel.sana.de 62.27.50.1	+10

Vulnerability Exposure

13 Critical 34 High 31 Medium 5 Low

Of 47 high-severity (CVSS ≥ 7.0) CVEs, 0 are validated (actively confirmed) and 47 are not validated — inferred from a service version banner only. Only validated CVEs affect the score. Not-validated CVEs are unconfirmed and may be false positives (for example a backported vendor patch that keeps the original version string), so they are excluded from scoring.

Not validated – version-inferred (47)

These match a reported software version, but validation was inadequate to confirm the vulnerability is present and exploitable. Not counted toward the score. Corroborate (e.g. confirm the running build and patch level) before treating them as real exposure.

CVE	CVSS	Where
CVE-2024-4577	9.8	karriere.sana.de 54.74.251.21:443
CVE-2024-8932	9.8	karriere.sana.de 54.74.251.21:443
CVE-2024-38476	9.8	karriere.sana.de 54.74.251.21:443
CVE-2024-38474	9.8	karriere.sana.de 54.74.251.21:443
CVE-2024-11236	9.8	karriere.sana.de 54.74.251.21:443
CVE-2026-29167	9.8	karriere.sana.de 54.74.251.21:443
CVE-2026-28780	9.8	karriere.sana.de 54.74.251.21:443
CVE-2026-44631	9.8	karriere.sana.de 54.74.251.21:443
CVE-2026-6722	9.5	karriere.sana.de 54.74.251.21:443
CVE-2024-11235	9.2	karriere.sana.de 54.74.251.21:443
CVE-2024-38475	9.1	karriere.sana.de 54.74.251.21:443
CVE-2025-23048	9.1	karriere.sana.de 54.74.251.21:443
CVE-2026-42535	9.1	karriere.sana.de 54.74.251.21:443
CVE-2026-24072	8.8	karriere.sana.de 54.74.251.21:443
CVE-2025-58098	8.3	karriere.sana.de 54.74.251.21:443
CVE-2025-14180	8.2	karriere.sana.de 54.74.251.21:443
CVE-2024-38473	8.1	karriere.sana.de 54.74.251.21:443
CVE-2024-8926	8.1	karriere.sana.de 54.74.251.21:443
CVE-2026-17543	8.1	karriere.sana.de 54.74.251.21:443
CVE-2024-5585	7.7	karriere.sana.de 54.74.251.21:443
CVE-2024-27316	7.5	karriere.sana.de 54.74.251.21:443
CVE-2024-38472	7.5	karriere.sana.de 54.74.251.21:443
CVE-2024-8927	7.5	karriere.sana.de 54.74.251.21:443
CVE-2024-47252	7.5	karriere.sana.de 54.74.251.21:443
CVE-2026-29169	7.5	karriere.sana.de 54.74.251.21:443

…and 22 more.

Open Ports & Services

Port	Service	Host
80	Apache httpd	img-micc.mitel.sana.de 62.27.50.1
443	Apache httpd	img-micc.mitel.sana.de 62.27.50.1
80	http	prod-extranet-portal.sana.de 195.227.115.252
443	Citrix Netscaler	prod-extranet-portal.sana.de 195.227.115.252
80	nginx	dsms.sana.de 85.235.65.219
443	nginx	dsms.sana.de 85.235.65.219
8822	OpenSSH 9.6p1 Ubuntu 3ubuntu13.18	dsms.sana.de 85.235.65.219
80	Apache httpd	mvz-mivb02.mitel.sana.de 62.27.3.3
443	Apache httpd	mvz-mivb02.mitel.sana.de 62.27.3.3
80	nginx	www.stimmungsbarometer.sana.de 116.202.187.158
443	nginx	www.stimmungsbarometer.sana.de 116.202.187.158
80	http	login.sana.de 93.122.71.7
443	Citrix Netscaler	login.sana.de 93.122.71.7
80	http	www.50-jahre.sana.de 78.47.211.231
443	https	www.50-jahre.sana.de 78.47.211.231
80	nginx	zukunftswerkstatt.sana.de 116.202.183.166
443	nginx	zukunftswerkstatt.sana.de 116.202.183.166
22	OpenSSH 9.6p1 Ubuntu 3ubuntu13.16	zukunftswerkstatt.sana.de 116.202.183.166
80	http	daten.sana.de 3.126.160.198
443	https	daten.sana.de 3.126.160.198
80	http	mail.sana.de 195.227.115.250
443	https	mail.sana.de 195.227.115.250
80	http	test-jobs.sana.de 89.168.68.25
443	http	test-jobs.sana.de 89.168.68.25
80	http	action.sana.de 216.239.32.21
443	https	action.sana.de 216.239.32.21
80	http	staging.sana.de 104.18.40.184
443	CloudFlare	staging.sana.de 104.18.40.184
80	Apache httpd 2.4.58	karriere.sana.de 54.74.251.21
443	Apache httpd 2.4.58	karriere.sana.de 54.74.251.21
80	Apache httpd	mvz-micollab.mitel.sana.de 62.27.50.3
443	Apache httpd	mvz-micollab.mitel.sana.de 62.27.50.3
80	http	email.news.sana.de 34.111.99.212
443	https	email.news.sana.de 34.111.99.212
80	http	preprod.sana.de 104.18.41.32
443	CloudFlare	preprod.sana.de 104.18.41.32
80	http	hintbox.sana.de 93.122.71.143
443	nginx	hintbox.sana.de 93.122.71.143
80	http	jobs.sana.de 130.61.171.155
443	http	jobs.sana.de 130.61.171.155

Technology Inventory

Apache httpdApacheHSTSApache HTTP ServerLet's EncryptCitrix NetscalerjQueryHammer.jsjQuery UIjQuery MigrateSlickEllipticCitrixDigiCert IncnginxOpenSSH 9.6p1 Ubuntu 3ubuntu13.189.6p1Guest-OneOpenSSH 9.6p1 Ubuntu 3ubuntu13.16Asseco Data Systems S.A.Google Cloud CDNGoogle CloudGoogleGoogle Cloud Load BalancingGoogle Trust ServicescloudflareCloudflareApache httpd 2.4.58Apache 2.4.582.4.588.3.6Azure Front DoorAzureMicrosoft CorporationPortalAWS ELB 2.0awselb 2.0Amazon ELBAmazon Web ServicesAmazonReactHetznerOracle CloudGCPAWSProofpoint

Important - how to read this rating. Security Rating Services (SRS) like FairSRS provide signals to help identify potential third-party risk from externally observable data. They should not be relied upon as the sole measure of an organization’s security posture. External signals are incomplete by nature. In particular, some organizations deliberately run deception technology (honeypots and decoy services) that is designed to appear vulnerable to lure and study attackers - such systems may surface here as risk signals but can actually reflect a mature, positive security program. Always corroborate these signals with direct assessment and evidence before drawing conclusions.

What is the FairSRS Score?

The FairSRS Score is a free security rating from 0 to 100 that measures a company’s externally observable security posture - the same outside-in signals a security team (or an attacker) can see without any access to the target’s internal systems. Enter any company domain above and FairSRS scans publicly available data to grade its third-party and vendor security risk in seconds, then generates a shareable report you can download as a PDF.

It’s powered by the free, open-source Fair TPRM platform and the same continuous security monitoring engine used inside our vendor risk management workflows - so the rating you see here is the same one security teams rely on to monitor their vendors.

What the score measures

Your FairSRS Score is a weighted blend of five externally observable security categories:

TLS / Cryptography - TLS protocol versions, certificate validity, HSTS, cipher strength, and post-quantum readiness.
Network Security - open ports, exposed services, WAF/CDN protection, and hosting posture.
Application Hardening - security headers, software version disclosure, exposed admin panels, and directory listings.
Vulnerability Exposure - known CVEs on internet-facing services, weighted by severity.
Email Security - SPF, DKIM, DMARC, and MTA-STS configuration that protects against spoofing.

Each finding is a signal that adds or subtracts points, producing a 0-100 score and an A-F grade. To turn these signals into quantified financial risk, pair them with FAIR risk analysis and a full GRC compliance program.

Recently scored vendors

Every domain below has a saved FairSRS Score you can open directly - no scan, no waiting, ranked highest score to lowest. Scores reflect the most recent scan and are re-checked when someone re-scans the domain.

Frequently asked questions

Is the FairSRS vendor security score really free?

Yes. FairSRS is completely free with no login, account, or credit card required. It is powered by the free, open-source Fair TPRM platform.

What does the FairSRS Score measure?

It measures a company’s externally observable security posture across five categories - TLS/cryptography, network security, application hardening, vulnerability (CVE) exposure, and email security - and combines them into a 0-100 score with an A-F grade.

How is the score calculated?

FairSRS analyzes publicly observable data about a domain - open services, TLS and certificate configuration, security headers, known CVEs, and DNS-based email protections such as SPF, DKIM and DMARC - and weights each signal to produce the score. No login or access to the target is required.

Is my data private?

Yes. No account is needed, and if you choose to have the report emailed, your address is used only to send that one report, encrypted in transit, then permanently deleted. We never store it, never sell or share it, and no one from Fair TPRM will contact you.

Can I scan any company or vendor?

Yes. Enter any public company domain to check its external security posture. It is designed to help you assess third-party vendors and suppliers.

How accurate is an external security rating?

A security rating provides signals to help identify risk, but it is not a complete picture and should not be the sole basis for judging a company’s security. Some organizations run deception technology that can appear vulnerable but reflects a mature program. Always corroborate with direct assessment.