Methodology

Every scan is external-only: SurfaceLoop probes the same surface an attacker can reach from the public internet. Each asset is assessed across seven risk categories:

• RB1 Exposed remote administration ports (SSH, RDP, VNC, WinRM), from a TCP port scan.
• RB2 Exposed web admin panels, default credentials and CVE-flagged software, detected with template-based scanning (Nuclei and SurfaceLoop's own checks).
• RB3 Weak TLS protocol versions and cipher suites.
• RB4 Certificate issues: expired, hostname-mismatched, self-signed, untrusted chains.
• RB5 Missing HTTP security headers on served web endpoints.
• RB6 Anomalous TCP symptoms -- services answering where they shouldn't, protocol mismatches.
• RB7 DNS and email spoofing controls: SPF, DKIM and DMARC presence and strength.

Raw scanner output becomes an observation; observations pass through a diff engine that assigns each finding a stable identity, so the same issue is tracked across scans as new, changed, still open, or fixed -- rather than re-reported as a fresh finding every time. Severity is assigned on a four-level scale (low, medium, high, critical) and is CVE-aware where a finding maps to a published CVE.

Reports on this site (such as the September 2026 exposure snapshot) are produced by a read-only aggregation over scan findings, under these rules:

• Aggregates only. Published output contains counts, percentages and medians -- never hostnames, IP addresses, or anything identifying a scanned organisation.
• Small-cell suppression. Categorical values (port numbers, header names, CVE identifiers) occurring fewer than three times are suppressed.
• Open findings only. Counts cover findings that were externally observable and unresolved at collection time; findings marked as false positives, and assets flagged as false positives, are excluded.
• Honest denominators. Percentages state their base explicitly (domains vs IP addresses), because some categories -- DMARC, for instance -- only apply to domains.
• Published limitations. Where a check produced no data for a cohort, the report says so rather than claiming a clean result. In the September 2026 snapshot, TLS protocol/cipher checks recorded no findings and were excluded from the category table for that reason.

Aggregate datasets are published in JSON and CSV under CC BY 4.0, so the numbers can be cited and checked against the page that presents them.