Datasets
Security base rates, measured in the open 31 controls measured passively across defined populations of domains, packages, certificates and networks — sliced by country , company size , ecosystem and issuing CA. Each figure is the share not meeting the control, with a 95% confidence interval. Aggregate-only; no company is ever named; free to reuse (CC BY 4.0).
91% What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? South Korea (networks) · n=933 Chosen automatically: the highest-severity control's worst credible segment (n≥400) · updates as measurements change All checks, by rate 27 controls, ranked by the share of the population not meeting each. Each row shows the control's worst credible segment — the slice of the population (n≥400) where the gap is widest.
Subject All Certificates 7 Email auth 5 Email transport 4 Supply chain 3 Transport 3 DNS integrity 2 Routing 2 Attack surface 2 Identity 2 Web hardening 1
Measured over All domains 24 packages 3 certificates 2 networks 2
% not meeting the control · higher is worse 0 50 100%
MTA-STS What share of France companies have no enforcing MTA-STS policy (absent or testing mode)? worst credible segment: France companies · n=862 · sev medium 100% Certificate lifetime readiness What share of certificates issued by SSL Corporation have a validity window longer than the 47-day maximum being phased in? worst credible segment: SSL Corporation (certificates) · n=2,143 · sev medium 100% TLS reporting What share of France companies have no TLS-RPT record? worst credible segment: France companies · n=862 · sev low 100% DANE for mail What share of France companies have no DANE/TLSA record binding their mail server's certificate? worst credible segment: France companies · n=845 · sev low 99% CAA record What share of UK small companies have no CAA record? worst credible segment: UK small companies · n=961 · sev low 98% Nameserver resilience What share of UK companies have all nameservers on a single provider? worst credible segment: UK companies · n=2,652 · sev low 98% DNSSEC What share of UK medium & large companies have no validated DNSSEC (unsigned, or signed with no DS at the parent)? worst credible segment: UK medium & large companies · n=1,061 · sev medium 96% RPKI route origin validation What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? worst credible segment: South Korea (networks) · n=933 · sev high 91% DMARC policy What share of domains worldwide have a DMARC policy that is absent or monitor-only (p=none)? worst credible segment: global domains · n=14,893 · sev high 86% Security headers What share of domains worldwide have no HSTS or Content-Security-Policy header? worst credible segment: global domains · n=13,660 · sev medium 85% Package provenance What share of packages on npm have no build-provenance attestation tying the artifact to its source? worst credible segment: npm (packages) · n=677 · sev medium 82% SPF policy What share of domains worldwide have no enforcing SPF record (absent, ~all soft-fail, or +all)? worst credible segment: global domains · n=14,893 · sev high 72% DMARC reporting What share of domains worldwide have dmarc-reporting? worst credible segment: global domains · n=6,632 · sev medium 72% Package maintenance What share of packages on npm have had no release in over two years? worst credible segment: npm (packages) · n=683 · sev medium 59% Post-quantum key exchange What share of domains worldwide have tls-pq-readiness? worst credible segment: global domains · n=1,704 · sev medium 51% HTTPS redirect What share of UK small companies have no redirect from http to https? worst credible segment: UK small companies · n=811 · sev medium 38% Package install scripts What share of packages on npm have an install script that runs on every install? worst credible segment: npm (packages) · n=677 · sev medium 32% Certificate lifetime What share of UK small companies have certificates issued for longer than the 47-day maximum? worst credible segment: UK small companies · n=696 · sev low 30% Subdomain sprawl What share of UK small companies have ten or more discoverable subdomains? worst credible segment: UK small companies · n=961 · sev low 21% Legacy TLS What share of domains worldwide have legacy TLS 1.0/1.1 still enabled? worst credible segment: global domains · n=13,478 · sev medium 15% Certificate trust What share of France companies have a certificate that is self-signed or invalid for its hostname? worst credible segment: France companies · n=588 · sev high 11% Certificate expiry What share of France companies have a TLS certificate expiring within 30 days, or expired? worst credible segment: France companies · n=550 · sev high 10% Mail server reverse DNS What share of France companies have a mail server with no reverse-DNS (PTR) record? worst credible segment: France companies · n=828 · sev low 8% Mail server certificate What share of domains worldwide have a mail server presenting a self-signed or expired certificate? worst credible segment: global domains · n=1,100 · sev medium 5% Subdomain takeover What share of UK medium & large companies have a subdomain that is a takeover candidate? worst credible segment: UK medium & large companies · n=1,061 · sev high 4% Mail transport encryption What share of UK small companies have a mail server that accepts mail without offering STARTTLS? worst credible segment: UK small companies · n=419 · sev high 2% Certificate crypto What share of domains worldwide have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)? worst credible segment: global domains · n=13,352 · sev medium 0% No datasets match that combination.
Context measures Composition of the same population — not failures, and deliberately not ranked above. They give the denominators the checks above sit inside.
For AI agents: MCP server Every dataset here is also served over MCP — an agent can look up a base rate, get the full measurement doc with citation metadata, and run a live check of a specific domain against it. Free, no auth; live checks are rate-limited.
claude mcp add --transport http quiet-failures https://mcp.quietfailures.com/mcpSix tools, other clients' config, limits and licensing: full MCP documentation → Prefer raw files? The catalog is at /datasets/manifest.json.json / .csv.