One fake request. Real money at risk.
A message that looks like it came from your business could persuade someone to send money to the wrong place.
Confirm changed payment details through a trusted phone number.
SAMPLE REPORT — fictional data for “sample-properties.example”. This is not a real assessment of any organization.
65
out of 100
Preliminary CyberScore for
sample-properties.example
Needs AttentionCoverage 95%Evaluated 1/15/2026, 3:00:00 PM
THE BUSINESS IMPACT
Your reputation is worth more than a score.
A convincing fake email. A payment sent to the wrong account. A customer who stops trusting your name. Security gaps can have consequences beyond a computer screen.
These are possible business risks, not findings of an attack on your business. This limited check does not establish fraud, downtime, stolen data or compromise. Pictures are illustrative.
When work stops, the cost keeps going.
A security incident could interrupt orders, customer service and everyday work. This check does not assess whether your business can recover.
Keep tested backups and a plan for working through an interruption.
Trust takes time to earn. And moments to lose.
Customers who cannot tell whether a message is genuine may hesitate to respond, pay or do business with you.
Give customers a known way to confirm unexpected requests.
Don’t wait for a suspicious message to start the conversation.
Ask your IT team to review the findings below. For a conversation about your business, contact FOS.
Disclaimer: This is a limited assessment of publicly observable security configuration. It is not a penetration test, complete vulnerability assessment, or guarantee of security.
Category results
SPF (Email sender policy)
100%
20.0 / 20 tested of 20 pts
DMARC (Email authentication)
28%
7.0 / 25 tested of 25 pts
HTTPS & transport security
100%
20.0 / 20 tested of 25 pts
Website security headers
48%
9.5 / 20 tested of 20 pts
CAA & DNS hygiene
50%
5.0 / 10 tested of 10 pts
Prioritized recommendations
- 01DMARC policy
Progress to p=quarantine, then p=reject.
- 02Content-Security-Policy
Introduce a CSP in report-only mode first.
- 03Referrer-Policy
Add Referrer-Policy: strict-origin-when-cross-origin.
- 04CAA record
Publish CAA records for the CAs you use.
- 05Strict-Transport-Security
Increase max-age to at least 180 days.
- 06DNSSEC validation
Consider enabling DNSSEC.
Verified observations
What could not be tested
- Certificate expiration window: Not available
Coverage below 100% means this is not a complete assessment. DKIM is not evaluated because it requires knowing your mail provider’s selectors. Internal networks, endpoints, and user practices are outside the scope of a public assessment.
Breach exposure — not performed
Breach-exposure check not performed in this report. Results are available only to a verified domain owner once a licensed data provider and domain-ownership verification are configured.
Breach-exposure checks cover only the sources a licensed provider indexes, up to its stated date limits. They are not exhaustive dark-web coverage, cannot prove absence of exposure, and a historical breach record does not mean an account is currently compromised. This module is unscored and does not affect the CyberScore.