Datasets
Security base rates, measured in the open 27 controls measured passively across defined populations of domains, packages, certificates and networks — sliced by country , company size , ecosystem and issuing CA. Each figure is the share not meeting the control, with a 95% confidence interval. Aggregate-only; no company is ever named; free to reuse (CC BY 4.0).
92% What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? South Korea (networks) · n=927 Chosen automatically: the highest-severity control's worst credible segment (n≥400) · updates as measurements change All checks, by rate 25 controls, ranked by the share of the population not meeting each. Each row shows the control's worst credible segment — the slice of the population (n≥400) where the gap is widest.
Subject All Certificates 6 Email auth 4 Email transport 4 Supply chain 3 DNS integrity 2 Transport 2 Attack surface 2 Identity 2 Routing 1 Web hardening 1
Measured over All domains 22 packages 3 certificates 1 networks 1
% not meeting the control · higher is worse 0 50 100%
Certificate lifetime readiness What share of certificates issued by ZeroSSL GmbH have a validity window longer than the 47-day maximum being phased in? worst credible segment: ZeroSSL GmbH (certificates) · n=858 · sev medium 100% MTA-STS What share of UK small companies have no enforcing MTA-STS policy (absent or testing mode)? worst credible segment: UK small companies · n=954 · sev medium 100% TLS reporting What share of France companies have no TLS-RPT record? worst credible segment: France companies · n=839 · sev low 100% CAA record What share of UK companies have no CAA record? worst credible segment: UK companies · n=2,597 · sev low 99% Nameserver resilience What share of UK medium & large companies have all nameservers on a single provider? worst credible segment: UK medium & large companies · n=1,025 · sev low 98% DANE for mail What share of UK small companies have no DANE/TLSA record binding their mail server's certificate? worst credible segment: UK small companies · n=551 · sev low 98% DNSSEC What share of UK medium & large companies have no validated DNSSEC (unsigned, or signed with no DS at the parent)? worst credible segment: UK medium & large companies · n=1,025 · sev medium 96% RPKI route origin validation What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? worst credible segment: South Korea (networks) · n=927 · sev high 92% DMARC policy What share of domains worldwide have a DMARC policy that is absent or monitor-only (p=none)? worst credible segment: global domains · n=15,007 · sev high 86% Security headers What share of domains worldwide have no HSTS or Content-Security-Policy header? worst credible segment: global domains · n=13,707 · sev medium 85% Package provenance What share of packages on npm have no build-provenance attestation tying the artifact to its source? worst credible segment: npm (packages) · n=678 · sev medium 83% SPF policy What share of domains worldwide have no enforcing SPF record (absent, ~all soft-fail, or +all)? worst credible segment: global domains · n=15,007 · sev high 72% Package maintenance What share of packages on npm have had no release in over two years? worst credible segment: npm (packages) · n=683 · sev medium 59% HTTPS redirect What share of UK small companies have no redirect from http to https? worst credible segment: UK small companies · n=825 · sev medium 36% Package install scripts What share of packages on npm have an install script that runs on every install? worst credible segment: npm (packages) · n=678 · sev medium 32% Certificate lifetime What share of UK small companies have certificates issued for longer than the 47-day maximum? worst credible segment: UK small companies · n=720 · sev low 30% Subdomain sprawl What share of UK small companies have ten or more discoverable subdomains? worst credible segment: UK small companies · n=954 · sev low 21% Legacy TLS What share of domains worldwide have legacy TLS 1.0/1.1 still enabled? worst credible segment: global domains · n=13,503 · sev medium 15% Certificate trust What share of France companies have a certificate that is self-signed or invalid for its hostname? worst credible segment: France companies · n=566 · sev high 13% Certificate expiry What share of France companies have a TLS certificate expiring within 30 days, or expired? worst credible segment: France companies · n=543 · sev high 10% Mail server reverse DNS What share of France companies have a mail server with no reverse-DNS (PTR) record? worst credible segment: France companies · n=805 · sev low 8% Mail server certificate What share of France companies have a mail server presenting a self-signed or expired certificate? worst credible segment: France companies · n=578 · sev medium 6% Subdomain takeover What share of UK medium & large companies have a subdomain that is a takeover candidate? worst credible segment: UK medium & large companies · n=1,025 · sev high 6% Mail transport encryption What share of UK small companies have a mail server that accepts mail without offering STARTTLS? worst credible segment: UK small companies · n=405 · sev high 3% Certificate crypto What share of France companies have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)? worst credible segment: France companies · n=543 · sev medium 1% No datasets match that combination.
Context measures Composition of the same population — not failures, and deliberately not ranked above. They give the denominators the checks above sit inside.
For AI agents: MCP server Every dataset here is also served over MCP — an agent can look up a base rate, get the full measurement doc with citation metadata, and run a live check of a specific domain against it. Free, no auth; live checks are rate-limited.
claude mcp add --transport http quiet-failures https://mcp.quietfailures.com/mcpSix tools, other clients' config, limits and licensing: full MCP documentation → Prefer raw files? The catalog is at /datasets/manifest.json.json / .csv.