Every check, in plain English.

Admin work should happen on dedicated cloud-only accounts — no mailbox attached (no inbox to phish), no on-prem sync (no AD compromise = no tenant compromise). This is CIS M365 control 1.1.1.

A code sent by text message or voice call can be stolen with a SIM swap or relayed through a phishing proxy (Evilginx, EvilProxy). Microsoft Authenticator is stronger, and passkeys (FIDO2) are the methods Microsoft counts as phishing-resistant.

Microsoft recommends two cloud-only Global Administrator accounts excluded from Conditional Access, so a bad policy, an expired federation certificate or an MFA outage cannot lock every administrator out of the tenant at once. This is a resilience control: without it, recovery from a lockout runs through Microsoft support and takes days.

Checks a universal MFA baseline or an enforcing policy covering the 14 documented reference admin roles. Exclusions, custom roles and effective sign-ins need separate review.

A code by text or an app approval can be relayed by a fake sign-in page. Passkeys, Windows Hello for Business and certificate-based MFA cannot. This checks that a Conditional Access policy makes admins use one of those for the same admin roles the admin MFA check covers.

Device code flow lets an attacker phish a working access token without a fake login page: the victim types a real code into a real Microsoft sign-in page, completes MFA themselves, and the resulting token goes to the attacker. Almost no organisation needs the flow, and Conditional Access can switch it off.

A Conditional Access policy only protects the people it applies to. Exclusion lists start as two break-glass accounts and grow — an exempt group here, a service account there — until the MFA policy the tenant believes is universal quietly isn't. This check reports who is exempt from the policies that enforce MFA and block legacy authentication.

Checks for a policy blocking both legacy client types across all users and applications. A restricted or excluded policy cannot establish tenant-wide blocking.

Checks for a mandatory MFA policy covering modern sign-ins for all users and applications, with policy exceptions and unsupported scopes left for review.

A Report-only Conditional Access policy is evaluated on every sign-in and then ignored — it writes a verdict to the log and lets the sign-in through regardless. Report-only is the correct place to START a policy, but a policy left there for months is protection the tenant believes it has and does not.

With Entra ID P2 you get Identity Protection — Microsoft scores every sign-in for risk (impossible travel, anonymous IP, leaked credentials, etc.). A CA policy that requires MFA or blocks high-risk sign-ins turns those signals into active defenses.

A location marked trusted is often allowed to skip MFA and counts as lower risk. This flags trusted address ranges of 65,536 addresses or more, which cover far more than one organisation's offices.

By default every user in a Microsoft 365 tenant can register applications, create new tenants and security groups, and read the BitLocker recovery key of their own devices. An attacker who gets into one ordinary account inherits all of that.

Whether joining or registering a device needs MFA, who may do it, who becomes local administrator during device join, and whether Microsoft Entra allows Windows LAPS backups. These tenant settings do not prove endpoint deployment or compliance.

Microsoft recommends 2-4 Global Administrators per tenant. Too few = no recovery if one is locked out; too many = oversized blast radius from a single compromised credential.

If 'everyone' or 'all members' can invite guests, any compromised user can create an attacker-controlled guest account, then use it as a persistence mechanism even after the original account's password is reset.

Microsoft Entra ID Protection matches your users against credential dumps found on the dark web and in law-enforcement seizures. An account flagged here has a password an attacker can already look up — the most direct route into a tenant there is, and one that no amount of perimeter hardening closes.

Old mail protocols such as IMAP, POP and SMTP AUTH sign in with a password alone and cannot ask for MFA. This reads the last 30 days of interactive sign-ins for them: a successful one is access no MFA policy covered, and failed ones are usually someone guessing passwords.

Forcing people to change their password on a schedule makes passwords weaker: they pick something predictable and change one character each time. Microsoft, CISA and CIS recommend passwords that do not expire, backed by MFA.

Lists the privileged changes made in your tenant recently — apps granted access, new app secrets, and accounts given admin roles. These are the first things an attacker does after getting in, because each one survives a password reset. They are also normal administration, so the point is to confirm each one was you.

Entra ID Protection rates every user's risk from Microsoft's signals — leaked passwords, anonymous or malicious IPs, impossible travel, token anomalies. A user left at risk is an signal that needs investigation. Open risk or an enabled account does not prove an active attacker or a successful sign-in.

Checks Security Defaults configuration or a supported Conditional Access MFA and legacy-auth baseline. Configuration does not establish an MFA challenge at every sign-in.

Admin accounts that haven't been used in 90+ days are likely former employees or unused service accounts. They hold privilege but receive no ongoing scrutiny — a near-perfect target for a patient attacker.

Guest accounts that haven't signed in for 90+ days are likely abandoned but still have access to whatever they were invited to. They're a common lateral-movement vector after a third-party breach.

Reports MFA registration gaps among the member accounts returned by Microsoft's registration report. Registration does not establish policy enforcement or observed authentication.

Defender for Office's anti-phishing policy uses ML to detect spoofed and impersonating senders. By default impersonation protection of executives is OFF — every tenant should add their executives explicitly.

IPs in the connection filter allow list bypass Defender for Office's spam/phish/malware scanning entirely. Large ranges, stale entries, or Microsoft's bulk-sender 'SafeList' create permanent backdoors past your email security.

Anti-malware policy blocks common malicious file types regardless of content (executables, scripts). Zero-hour Auto Purge (ZAP) retroactively removes mail from inboxes when Defender later identifies it as malware or phish — critical when threat signatures arrive minutes after delivery.

Safe Attachments detonates inbound attachments in a sandbox before delivery. Without it, malicious documents reach users immediately, relying on the recipient's endpoint AV — which often runs minutes after the user has already opened the file.

Safe Links rewrites URLs in email, Teams chats, and Office apps so Microsoft can check them at click time (after attackers' detonation evasion has fired). Microsoft's built-in protection applies a basic Safe Links policy to every licensed mailbox by default. Exceptions to it, the stricter Standard and Strict presets, and Safe Links for Office apps are what an admin controls.

Each allow entry in the Tenant Allow/Block List bypasses Defender's spam, phish, and malware verdicts for the matching sender/URL/file. Permanent (no-expiration) and forgotten old entries become backdoors past your phishing protection.

DKIM cryptographically signs outbound mail so receivers can verify it wasn't altered or spoofed. Without DKIM, DMARC enforcement is effectively weaker since SPF alone is fragile under forwarding.

DMARC tells receiving mail servers what to do with email that fails SPF and DKIM. Without it (or with p=none), attackers can spoof your domain with impunity — a primary BEC technique.

Outlook's 'External' tag marks every inbound message from outside the tenant. It's a simple but highly effective UX defense against CEO impersonation and fake-IT phishing — users learn to scrutinize external messages that claim to be internal.

MTA-STS tells sending servers to require TLS when delivering mail to your domain, preventing on-path attackers from stripping encryption. TLS-RPT surfaces when delivery TLS is failing or being downgraded.

Inbox rules are the most common BEC persistence mechanism. Attackers create forwarding rules to exfiltrate mail in real time, or delete/move rules keyed on words like 'phish' or 'security' to hide their tracks. Microsoft's own incident reports consistently rank this as the #1 post-compromise action.

Publishing the MTA-STS DNS record is only half of it — sending servers also fetch a policy file over HTTPS. If that file is missing or malformed, they ignore your policy entirely and mail can still be downgraded to an unencrypted connection.

If the domain's MX record points somewhere other than M365, mail isn't flowing through Exchange Online Protection — meaning Defender for Office, anti-phish, Safe Links, and the rest of M365's mail filtering aren't actually inspecting inbound mail. Often unintentional after a migration.

If users can auto-forward email externally via inbox rules, an attacker who phishes one account silently exfiltrates ALL inbound mail to their own address — surviving password resets and session terminations.

Without sensible outbound rate limits, a compromised account can send tens of thousands of phishing emails (to internal users, to your customers) before Microsoft's tenant-level limits kick in. Tight per-user limits AND BlockUser action when the limit is hit contain the blast radius of any single account compromise.

SPF authorizes which mail servers may send for your domain. Missing, soft-fail (~all), or too-many-lookups SPF records let spoofed mail through.

A single transport rule can bypass spam filtering tenant-wide, redirect mail to attacker addresses, or strip Microsoft-added authentication headers. Far higher leverage than per-mailbox rules, and far less commonly reviewed.

By default, ANY user from ANY external Microsoft Entra tenant can be added as a guest in your tenant. Combined with permissive Teams settings, this lets attackers in any tenant DM and share files with your users — bypassing email security entirely.

B2B Direct Connect lets users from other tenants access your data without becoming guests in your directory. This bypasses guest-account lifecycle controls, access reviews, and many CA policies that target guests specifically. Should be enabled only with vetted partner tenants.

OneDrive external sharing is controlled by the tenant-wide external sharing setting and, per Microsoft, can only be equal to or more restrictive than SharePoint — never more permissive. This informational check surfaces OneDrive's effective ceiling; the tenant-wide level itself is graded by the SharePoint external sharing check. (The OneDrive-specific override is not exposed by the read-only Graph API.)

When SharePoint allows 'Anyone' links, any user can generate an unauthenticated URL that grants access to a file or folder — no sign-in required. These links leak via screenshots, forwarded emails, and search engines.

If Anyone links don't expire, a single leaked URL remains exploitable indefinitely. Forcing a max lifetime (≤30 days is industry standard) limits the damage window when a link inevitably ends up somewhere unintended.

When users click Share without changing options, the link defaults to this permission level. Edit-by-default means recipients can modify or delete content — including invoices, contracts, customer lists.

If guests can re-share, content fans out to people you never invited or audited. Each re-share is invisible to you and survives even if the original guest's access is revoked.

SharePoint has its own legacy-auth toggle separate from the tenant-wide Conditional Access block. When enabled, certain SharePoint-specific basic-auth and ACS-based flows bypass modern identity controls.

Without this restriction, users can sync OneDrive (and SharePoint libraries) to ANY device including personal laptops. A user keeping a synced copy on a personal device circumvents BitLocker, MDM remote wipe, and conditional access — all your tenant controls only apply while the data is in M365.

If anonymous users can join Teams meetings AND auto-bypass the lobby, attackers can silently join scheduled meetings using only the meeting link — which routinely leaks via calendar invites, support tickets, and screenshots. They can then record audio/video and read chat.

If users can install custom (sideloaded) Teams apps, an attacker who phishes a user can deliver an OAuth-grant attack via Teams — bypassing email security and the typical consent-attack UX users are trained on.

If enabled, any person with a free Microsoft account (Teams Personal) can DM and call your users. This is a primary Teams phishing vector — attackers spoof internal user display names and message employees with credential-harvesting links.

Without a domain allowlist, your users can be DM'd by users from any external Entra tenant. While the Cross-tenant Access policy controls guest invites, this is the separate control governing who can initiate Teams chats and calls from outside your tenant.

If you've restricted user consent (recommended), users need a way to request admin approval for legitimate apps. Without an admin consent workflow, users either go without the app or find workarounds.

App registration secrets that expire silently cause outages; secrets with multi-year validity are credential-stuffing magnets if leaked. Both worth knowing about.

Reviews delegated grants against the target API. User-specific consent does not identify who granted consent, and granted scopes do not prove active access or bypass of authentication controls.

Whoever owns an app can add a secret to it and sign in as the app, with all of its permissions and no MFA. This lists apps registered here that hold high-risk Microsoft Graph permissions and are owned by someone who is not an app administrator.

A redirect URI is the address Entra delivers sign-in tokens to. Wildcards, plain http, and leftover localhost entries widen that address from one host you control to a range someone else might occupy — turning your own app registration into a token delivery service for an attacker.

Reviews granted application permissions against their target API. Known broad Microsoft Graph grants are flagged; other APIs and unresolved permissions require review. Grants do not prove effective access or exploitation.

Passwords or certificates added to a service principal (not its app registration) let anyone holding them authenticate as the app. On a third-party app this is the classic persistent backdoor.

An app registration nobody has used in months, that still holds application permissions or a live secret, is a standing credential with no owner watching it. Nobody notices when it starts being used, and nobody would miss it if it were deleted — which is exactly what makes it attractive to an attacker.

If end users can consent to OAuth apps without admin approval, illicit consent attacks succeed: a phishing-like link grants an attacker-controlled app permission to read mail and files, bypassing MFA entirely.

Review known vulnerabilities reported by Defender, grouped by affected software with distinct CVE and device counts. A CVE observation is not proof of exploitation.

Corporate Windows devices should be covered by Defender for Endpoint/Business (EDR, not just signature AV) with tamper protection enabled so malware can't switch Defender off. This reports the tenant's Defender licensing capability and per-device tamper-protection state — the signals readable via Microsoft Graph. (Per-device MDE onboarding status isn't exposed by Graph; it lives in the Defender portal's machines API.)

Review active Defender recommendations and documented exceptions for the visible device inventory. Recommendations are grouped into one control rather than counted as individual security checks.

Review sensor health, onboarding state and seven-day reporting freshness for devices returned by the optional Defender connection. This does not establish coverage of every device in the organization.

Defender XDR surfaces alerts from MDE, MDO, MDI, and MDA in a unified queue. High-severity alerts in 'New' or 'InProgress' status for >7 days are a strong indicator of either an unstaffed security function or an in-progress incident that's stalled.

Reviews iOS and Android app-protection assignments. Policy configuration does not establish protection for every app or device; other Intune workloads are outside this check.

Without BitLocker, a stolen or lost Windows device exposes all cached data — OneDrive sync content, cached Outlook PSTs, saved attachments, Teams cache — to anyone who removes the disk and reads it. Encryption is the foundational endpoint control.

Compliance policies + enrolled devices only matter if a CA policy actually requires compliance before granting access. Without this grant, an attacker on a non-Intune device can sign in with valid credentials and access corp resources just as easily as a compliant managed device.

Without a compliance policy for a given OS, every device on that OS is in 'unknown' compliance state. CA policies that 'require compliant device' silently let those devices through (or block them all, depending on the rule design) because there's no compliance evaluation.

Devices in 'noncompliant', 'conflict', or 'error' state have failed their compliance policy. With a CA policy requiring compliant devices, they're blocked from corp resources. Without one, they're still accessing data despite failing the controls you've defined.

Devices that haven't synced for 30+ days are likely lost, decommissioned, or belong to former employees. They distort your compliance metrics, occupy licenses, and represent potential offline-data exposure if lost or stolen.

Activity Log alerts notify on high-risk operations (role assignment changes, NSG edits, security-solution deletions) in near-realtime. Catching these as they happen beats finding them in a quarterly review.

Without an Activity Log → Log Analytics diagnostic setting, control-plane events (role changes, NSG edits, resource deletes) only retain 90 days natively. Most security investigations need year-plus retention.

WAF disabled, or in Detection mode, doesn't block attacks. Production App Gateways should run WAF in Prevention mode (blocks + logs).

Reads App Service platform authentication settings. Apps may intentionally use their own authentication or serve public content; this check does not prove anonymous access or internet reachability.

App Services should have httpsOnly=true so HTTP traffic is auto-redirected. Avoids credentials and cookies traveling in cleartext during the initial request.

Reads the App Service web configuration and checks that the application endpoint requires TLS 1.2 or later. Deployment slots and the separate SCM endpoint are outside this check's scope.

Every virtual machine should be protected by Azure Backup with a healthy, recent recovery point. Unbacked-up VMs are unrecoverable after ransomware, accidental deletion, or a failed change — the restore simply does not exist.

Recovery Services and Backup vaults should have soft delete enabled so that backup data deleted by a compromised or mistaken administrator is retained and recoverable rather than destroyed immediately.

DDoS Protection Standard mitigates volumetric attacks against public IPs. Only VNets containing public-IP attached workloads are evaluated — pure internal VNets don't need it.

Defender for Cloud's per-workload plans (Servers, Storage, SQL, etc.) provide threat-detection signal on each workload type. Subscriptions on the Free tier only get configuration recommendations — no runtime threat protection.

Per-subscription roll-up of the top 5 unhealthy high-severity Defender for Cloud recommendations. Informational — drives the 'what Defender thinks' dashboard panel. Never fails on its own.

Per-resource diagnostic settings forward data-plane logs (storage requests, KV accesses, SQL audits, NSG flow logs) to Log Analytics. Coverage <80% across critical resource types indicates substantial blind spots for forensic investigation.

Front Door WAF is opt-in per frontend. Frontends without an attached WAF policy are unprotected against OWASP attacks and bot traffic.

Custom roles whose actions include `*`, `*/*`, or `Microsoft.Authorization/*` grant near-Owner privileges and bypass least-privilege. Microsoft.Authorization/* in particular is a privilege-escalation primitive (holder can grant themselves Owner).

Reviews direct role assignments using explicit directory evidence. Unknown identities remain unverified; effective access and group membership require separate review.

Managed identities eliminate stored credentials for service-to-service auth. Coverage <50% suggests significant credential-rotation debt; <80% is a hygiene target worth working toward.

Reviews direct role assignments using explicit directory evidence. Unknown identities remain unverified; effective access and group membership require separate review.

PIM lets users hold privileged Azure roles as eligible rather than active, requesting just-in-time activation. Substantially reduces standing-access blast radius. Requires Entra ID P2.

Service principals holding Owner or Contributor at subscription level have authority across every resource in the subscription. Scope them down to the specific resource groups they need.

Reviews credential dates for directly assigned Azure service principals and their locally owned app registrations. Flags active credentials older than 365 days or configured for more than 365 days. Group-derived access and publisher-owned registrations are not fully assessed.

Microsoft recommends ≤2 Owners per subscription. Each Owner is a tenant-wide compromise risk; reducing the count reduces the blast radius of a phished credential.

Key Vaults with publicNetworkAccess=Enabled expose the management endpoint to the internet. Disable and configure private endpoints for the applications that need vault access.

RBAC authorization integrates Key Vault with PIM, conditional access, and central RBAC auditing. Legacy Access Policies are vault-local and can't be governed centrally.

Soft delete retains deleted vaults/keys for 90 days; purge protection blocks force-delete during that window. Together they protect against scenarios where attackers delete keys to lock out the owner.

Workspace retention <90 days truncates data before most breach investigation windows. CIS recommends ≥90 days; PCI-DSS and HIPAA require at least 1 year of accessible logs.

MCSB is Microsoft's canonical Azure security baseline. Assigning it at the subscription or management-group root gives continuous compliance scoring in Defender for Cloud.

MySQL Single Server: sslEnforcement should be Enabled. Flexible Server: require_secure_transport server parameter should be ON. Without these, clients can connect in plaintext.

Database ports (1433, 3306, 5432, 27017, 6379) open to *, Internet, or 0.0.0.0/0 expose databases to credential-stuffing, unauthenticated access (Redis default), and data exfiltration.

Any-protocol, any-source, any-port Allow rules defeat the principle of least connectivity and provide lateral-movement paths even when not directly internet-exposed.

TCP/3389 open to *, Internet, or 0.0.0.0/0 exposes Windows RDP to the internet. Public RDP is a primary initial-access vector for ransomware.

TCP/22 open to *, Internet, or 0.0.0.0/0 lets the world brute-force SSH. Use Bastion / VPN / IP allowlists instead.

Managed disks in the Unattached state are billed at full provisioned capacity while serving no workload, and still contain a complete readable copy of whatever the deleted VM held.

Network interfaces attached to no VM, public IPs attached to no resource, and network security groups attached to no subnet or NIC. Billed or reserved for nothing, and — in the NSG case — usually a rule set someone believes is in force.

Postgres Single Server: sslEnforcement should be Enabled. Flexible Server: require_secure_transport server parameter should be ON. Without these, clients can connect in plaintext.

Catalogs every public IP in scope and what resource it's attached to. Never fails — purely informational. These IPs are also fed into the external attack surface (Shodan/crt.sh) as seed inputs.

SQL Servers without an AAD admin force clients onto local SQL auth, which doesn't support MFA / conditional access / centralized governance.

Firewall rules permitting 0.0.0.0 → 255.255.255.255 (all IPv4) or 0.0.0.0 → 0.0.0.0 (all Azure services) expose the SQL Server to anything on the internet or the entire Azure fleet.

TDE encrypts data at rest with negligible perf impact. On by default for new databases; older ones may still have it off.

Defender for SQL detects SQL injection attempts, brute force, and anomalous access patterns. Requires Defender for Cloud's SQL plan.

A container with publicAccess set to Blob or Container permits anonymous access at the container level. Effective access also depends on account-level anonymous-access permission and network restrictions; this setting alone does not prove internet readability.

Blob soft delete protects against accidental and malicious deletion. Microsoft recommends ≥7-day retention; longer is better for ransomware recovery.

networkAcls.defaultAction = Allow means the storage firewall is open to any network. Set Deny with explicit allowlists or private endpoints.

minimumTlsVersion below TLS 1.2 lets clients negotiate weaker cipher suites and breaks PCI-DSS / FedRAMP / most enterprise compliance baselines.

Private endpoints let storage accounts be reached only over the VNet, eliminating public network exposure. Coverage <50% indicates substantial public-surface storage; ≥80% is a hygiene target worth pursuing.

When allowBlobPublicAccess is true, individual containers can opt into anonymous internet access. Disabling at the account level enforces the secure default across every container.

Storage accounts with supportsHttpsTrafficOnly=false accept plaintext HTTP requests. Forces all REST API calls to use TLS when enabled.

VM disks should be encrypted via encryptionAtHost (preferred) or Azure Disk Encryption (legacy). Default platform encryption protects only the underlying storage; per-VM controls protect against escape scenarios.

Defender for Endpoint provides EDR on the guest OS. Coverage below 80% indicates onboarding debt; below 50% means significant attack surface is unmonitored. With a Defender for Servers plan, Defender for Cloud installs the sensor on supported machines by default.

VMs with a directly attached public IP expose the host to the internet. Prefer Azure Bastion (for admin access) or App Gateway / LB with WAF (for app traffic) rather than direct public IP exposure.

VMs on EOL operating systems receive no vendor security patches. Migrate to a supported image or apply Microsoft Extended Security Updates (paid).

Logs are useful only if someone reads them. Microsoft Defender ships high-value alerts (new forwarding rule, admin role elevation, suspicious forwarding activity) that go to nobody by default unless an admin sets email recipients. Untriaged alerts are equivalent to no detection.

Mailbox auditing is the foundation for ALL post-incident investigation of an account compromise. Without it, you cannot tell what an attacker did inside a mailbox — when they signed in, what mail they read, what rules they created, what they deleted. Critical actions like UpdateInboxRules must be in the default owner audit set.

Microsoft sends service-health incidents, security advisories, and license/billing notifications to addresses on file in the tenant. If these default to the original signup contact (often a personal email of a long-departed admin), important messages — including Microsoft's own breach notifications to your tenant — get lost.

The unified audit log records sign-ins, file accesses, admin actions, policy changes — everything you'd need to investigate an incident. Whether it's ingesting is an Exchange/Purview setting our read-only Graph access cannot read, so we surface it for one-command verification rather than guessing from unrelated Entra logs.

Roll-up of every domain, IP, and exposed service Tenant Strike discovered from the outside-in view. Verify each entry corresponds to a known business system — anything unrecognized is a shadow-IT or decommissioned-but-still-on asset that warrants investigation.

Shodan, a public index of internet-facing systems, lists the published vulnerabilities (CVEs) that match the software it saw on each address. Unless Shodan marks a match verified, it is inferred from that software and its version and has not been tested against the service. The same index is open to anyone, so an attacker can read the same list.

DNSSEC signs your DNS records so resolvers can detect tampering; CAA records restrict which certificate authorities may issue certificates for your domain. Both limit attacks that impersonate your domain.

An expired domain takes email and your website offline at the same time, and lets someone else register it and receive your mail. A registrar transfer lock is a free setting that blocks one leg of a domain hijack.

Web admin interfaces (phpMyAdmin, cPanel, Jenkins, Kibana, vCenter, etc.) should be accessible only from a trusted network or behind an identity-aware proxy. Public exposure invites credential stuffing and exploitation of the steady stream of CVEs these products ship.

Databases should always be private — behind a VPC/VNET, accessible only from the application tier. Public exposure represents either a misconfigured cloud instance or a legacy server that was never moved behind a firewall. Many database engines (Mongo, ES, Redis) ship with no authentication by default.

Remote-management protocols (RDP, SMB, WinRM, VNC), hosting control panels (cPanel, WHM, Control Web Panel, Webmin) and cleartext file transfer (FTP) should be reachable only through a VPN or zero-trust gateway. Direct internet exposure of these is the leading initial-access vector for ransomware and remote-access breaches.

Attackers register domains that resemble yours (character swaps, extra words, alternate TLDs) to send phishing and business-email-compromise mail that looks like it's from you. A lookalike with an MX record is infrastructure ready to send.

In October 2026 the PHP project fixed two critical flaws that let anyone run code on a web server without signing in. This reads the PHP version a public website announces and says whether it predates the fix, or that the site runs PHP without showing which version.

abuse.ch publishes blocklists of hostnames serving malware (URLhaus) and botnet command-and-control IPs (Feodo Tracker). If one of your own assets is listed, it has been compromised and is being used against others — and it will also get your mail and traffic blocked.

Security response headers (HSTS, X-Frame-Options / CSP, X-Content-Type-Options) harden your public web login pages against SSL-stripping, clickjacking, and MIME-confusion attacks.

A small text file at /.well-known/security.txt tells anyone who finds a security problem in your systems exactly how to reach you. Without one, reports go to a general inbox and often get missed.

Shodan labels indexed hosts with tags such as compromised, malware, database, or ics. A flag on one of your own hosts is an independent signal that it's breached or exposing something it shouldn't.

A subdomain whose CNAME points at a deleted cloud resource (S3 bucket, Azure web app, GitHub Pages site, etc.) can be re-registered by anyone, who then serves content — with valid TLS — on your own domain. Prime phishing and cookie-theft infrastructure.

TLS certificates that are expired, near-expiry, self-signed, or signed with weak algorithms cause user-facing errors or outages and erode trust.

Deprecated TLS/SSL protocol versions (SSLv2, SSLv3, TLS 1.0, TLS 1.1) are vulnerable to downgrade and cipher attacks, fail PCI-DSS, and are rejected by up-to-date browsers and API clients.

A version of Windows or Exchange Server that Microsoft has stopped supporting gets no fix for flaws found after that date. On a machine reachable from the internet, each new flaw stays open for good.

A website can tell a visitor's browser to always use an encrypted connection, to refuse being shown inside another site's frame, and not to guess a file's type. A home page sent without them leaves the browser on its looser defaults.

A website built on WordPress shows visitors which version it runs and which plugins it uses. WordPress.org says which versions later releases have replaced and which plugins it has closed, and a site that shows one of those is worth a look.

A website can announce the software it runs on to every visitor. When that is a version its maker has stopped fixing, flaws found afterwards stay open unless the hosting company patches it itself. PHP, the Apache web server and Microsoft's IIS are the software judged today.