Datasets

Security base rates, measured in the open

27 controls measured passively across defined populations of domains, packages, certificates and networks — sliced by country, company size, ecosystem and issuing CA. Each figure is the share not meeting the control, with a 95% confidence interval. Aggregate-only; no company is ever named; free to reuse (CC BY 4.0).

91% What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? South Korea (networks) · n=928 Chosen automatically: the highest-severity control's worst credible segment (n≥400) · updates as measurements change

All checks, by rate

25 controls, ranked by the share of the population not meeting each. Each row shows the control's worst credible segment — the slice of the population (n≥400) where the gap is widest.

MTA-STS What share of UK small companies have no enforcing MTA-STS policy (absent or testing mode)? worst credible segment: UK small companies · n=954 · sev medium 100%
TLS reporting What share of France companies have no TLS-RPT record? worst credible segment: France companies · n=839 · sev low 100%
Certificate lifetime readiness What share of certificates issued by Google Trust Services have a validity window longer than the 47-day maximum being phased in? worst credible segment: Google Trust Services (certificates) · n=3,238 · sev medium 99%
CAA record What share of UK companies have no CAA record? worst credible segment: UK companies · n=2,597 · sev low 99%
DANE for mail What share of UK small companies have no DANE/TLSA record binding their mail server's certificate? worst credible segment: UK small companies · n=551 · sev low 98%
Nameserver resilience What share of UK medium & large companies have all nameservers on a single provider? worst credible segment: UK medium & large companies · n=1,025 · sev low 98%
DNSSEC What share of UK medium & large companies have no validated DNSSEC (unsigned, or signed with no DS at the parent)? worst credible segment: UK medium & large companies · n=765 · sev medium 97%
RPKI route origin validation What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated? worst credible segment: South Korea (networks) · n=928 · sev high 91%
Security headers What share of domains worldwide have no HSTS or Content-Security-Policy header? worst credible segment: global domains · n=13,742 · sev medium 87%
DMARC policy What share of domains worldwide have a DMARC policy that is absent or monitor-only (p=none)? worst credible segment: global domains · n=15,007 · sev high 86%
Package provenance What share of packages worldwide have no build-provenance attestation tying the artifact to its source? worst credible segment: all packages · n=679 · sev medium 85%
SPF policy What share of domains worldwide have no enforcing SPF record (absent, ~all soft-fail, or +all)? worst credible segment: global domains · n=15,007 · sev high 72%
Package maintenance What share of packages on npm have had no release in over two years? worst credible segment: npm (packages) · n=683 · sev medium 60%
HTTPS redirect What share of UK small companies have no redirect from http to https? worst credible segment: UK small companies · n=834 · sev medium 35%
Package install scripts What share of packages on npm have an install script that runs on every install? worst credible segment: npm (packages) · n=679 · sev medium 32%
Certificate lifetime What share of UK small companies have certificates issued for longer than the 47-day maximum? worst credible segment: UK small companies · n=722 · sev low 30%
Subdomain sprawl What share of UK small companies have ten or more discoverable subdomains? worst credible segment: UK small companies · n=954 · sev low 21%
Legacy TLS What share of domains worldwide have legacy TLS 1.0/1.1 still enabled? worst credible segment: global domains · n=13,592 · sev medium 16%
Certificate trust What share of France companies have a certificate that is self-signed or invalid for its hostname? worst credible segment: France companies · n=574 · sev high 13%
Mail server reverse DNS What share of France companies have a mail server with no reverse-DNS (PTR) record? worst credible segment: France companies · n=805 · sev low 8%
Certificate expiry What share of UK small companies have a TLS certificate expiring within 30 days, or expired? worst credible segment: UK small companies · n=721 · sev high 7%
Mail server certificate What share of France companies have a mail server presenting a self-signed or expired certificate? worst credible segment: France companies · n=578 · sev medium 6%
Subdomain takeover What share of UK medium & large companies have a subdomain that is a takeover candidate? worst credible segment: UK medium & large companies · n=1,025 · sev high 6%
Mail transport encryption What share of UK small companies have a mail server that accepts mail without offering STARTTLS? worst credible segment: UK small companies · n=405 · sev high 3%
Certificate crypto What share of France companies have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)? worst credible segment: France companies · n=545 · sev medium 1%

Context measures

Composition of the same population — not failures, and deliberately not ranked above. They give the denominators the checks above sit inside.

Identity federation What is the split between cloud-managed and federated sign-in of domains worldwide? cloud-managed · 94%

cloud-managed · 93.82%federated · 6.18%

composition of global domains · n=437 — a make-up, not a failure rate
Identity platform What is the identity-platform mix (Microsoft Entra / Google Workspace / neither) of domains worldwide? other / none · 69%

Microsoft 365 · 21.85%Google Workspace · 9.5%other / none · 68.65%

composition of global domains · n=2,000 — a make-up, not a failure rate

For AI agents: MCP server

Every dataset here is also served over MCP — an agent can look up a base rate, get the full measurement doc with citation metadata, and run a live check of a specific domain against it. Free, no auth; live checks are rate-limited.

claude mcp add --transport http quiet-failures https://mcp.quietfailures.com/mcp

Tools: list_base_rates · find_base_rate · get_base_rate · check_email_auth · check_subdomain_takeover · check_whois. Prefer raw files? The catalog is at /datasets/manifest.json and every dataset page has .json / .csv.

Each control is measured once a week on a fixed weekday, since 2026-08-01 — so figures for different controls can be up to six days apart, and each dataset states its own measurement date. Aggregate-only — no company is ever named. A slice is published only where it holds at least 100 measured members, so an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0; every page has .json / .csv downloads.