{
  "anonymisation": "Aggregates only; categorical cells below 3 suppressed; no hosts, IPs, or organisation identities.",
  "scope": {
    "assets_total": 1083,
    "domains": 778,
    "apex_domains": 778,
    "ip_assets": 305,
    "cidr_assets": 0,
    "asset_window": "since 2026-09-15"
  },
  "findings": {
    "open_total": 3760,
    "assets_with_at_least_one_finding_pct": 83.3,
    "by_severity": {
      "medium": 843,
      "high": 717,
      "low": 2089,
      "critical": 111
    },
    "by_category": {
      "RB1": {
        "label": "Exposed remote admin ports (SSH, RDP, VNC, WinRM)",
        "open_findings": 111,
        "assets_affected_pct": 10.2
      },
      "RB2": {
        "label": "Exposed web admin panels and CVE findings",
        "open_findings": 531,
        "assets_affected_pct": 27.1
      },
      "RB3": {
        "label": "Weak TLS versions or cipher suites",
        "open_findings": 0,
        "assets_affected_pct": 0
      },
      "RB4": {
        "label": "Certificate issues (expired, mismatched, self-signed)",
        "open_findings": 186,
        "assets_affected_pct": 15.7
      },
      "RB5": {
        "label": "Missing HTTP security headers",
        "open_findings": 1835,
        "assets_affected_pct": 73
      },
      "RB6": {
        "label": "Anomalous TCP symptoms",
        "open_findings": 242,
        "assets_affected_pct": 18.6
      },
      "RB7": {
        "label": "DNS/email spoofing risk (SPF, DMARC, DKIM)",
        "open_findings": 855,
        "assets_affected_pct": 53.1
      }
    },
    "top_exposed_admin_ports": {
      "22/tcp": 111
    },
    "top_missing_security_headers": {},
    "top_cves": {
      "CVE-2020-12272": 534,
      "CVE-2016-9963": 254,
      "CVE-2020-28037": 174,
      "CVE-2023-48795": 111,
      "CVE-2024-7209": 67
    }
  },
  "structure": {
    "median_subdomains_per_apex": 0,
    "apexes_with_subdomains_pct": 0
  },
  "per_asset_type": {
    "domains_base": 778,
    "ips_base": 305,
    "any_open_finding_pct": {
      "domains": 95.4,
      "ips": 52.5
    },
    "high_or_critical_pct": {
      "domains": 58.4,
      "ips": 38.0
    },
    "by_category_pct_of_domains": {
      "RB1": 11.8,
      "RB2": 37.8,
      "RB4": 8.6,
      "RB5": 85.6,
      "RB6": 18.6,
      "RB7": 73.9
    },
    "by_category_pct_of_ips": {
      "RB1": 6.2,
      "RB2": 0.0,
      "RB4": 33.8,
      "RB5": 41.0,
      "RB6": 18.4,
      "RB7": 0.0
    }
  },
  "top_missing_security_headers": {
    "permissions-policy": 1777,
    "content-security-policy": 1563,
    "referrer-policy": 1486,
    "x-content-type-options": 1250,
    "x-frame-options": 1231,
    "strict-transport-security": 632
  },
  "dataset": "SurfaceLoop UK SME External Exposure Snapshot, September 2026 \u2014 anonymised aggregates"
}