How every index in the report
is actually computed.

What the methodology commits to before any individual index.

The exposure headline, then each index it rolls up. 0–100, higher is worse: Low / Elevated / High / Critical.

CXI = Σ_i  w_i · normalize(index_i)     i ∈ {CES, IMI, RPS, BLV, BIR}

CES = 100 · anchoredσ( (0.7·ln(1+stealer_hits) + 0.3·ln(1+breach_addrs)) / 2.2 − 1.0 )

IMI = 100 · anchoredσ( ln(1 + manual + ln(1 + intelx + telegram + otx_capped))·1.4 + price − 1.0 )

RPS = 100 · anchoredσ( (0.30·KEV + 0.25·EPSS + 0.15·VictimSim + 0.10·Infra) / 0.80 / 6 − 1.5 )

BLV = 100 · anchoredσ( ln(1 + 3·leak_site_mentions + phishing_urls) / 1.4 − 0.6 )

BIR = Σ_surface (count × audience_weight × persistence);   score = 100 · anchoredσ( ln(1 + weighted_reach) / 1.6 − 0.8 )

The market headline, then the peer-relative diagnostics. 0–100, higher is better: Weak / Moderate / Strong / Dominant.

MPI = Σ_i  w_i · normalize(index_i)     i ∈ {WTI, SVI, BZV, SRS}

WTI = 100 · (1 − log₁₀(rank) / log₁₀(10M))

SVI = mean(GoogleTrends₀₋₁₀₀, WikipediaPageviews→0₋₁₀₀)

BZV = 100 · anchoredσ( ln(1 + weekly_mentions) / 1.5 − 1.0 )

SRS = mean(GDELT_tone→0₋₁₀₀, NewsLexicon→0₋₁₀₀)

SOV = 100 · client_mentions / Σ peer-set mentions

CTB = 100 · (n − position) / (n − 1)

FLR = 100 · anchoredσ( ln(1 + 2·homepage_changes + launch_press) / 1.4 − 0.6 )

Enumerated. Contractual.

The sources we collect from are part of the contract. Adding a source requires a methodology version bump and a notice to existing clients. Removing a source likewise. Source weights are reviewed quarterly.

Hashed at ingest. Dereferencing requires verified ownership.

The minimum-necessary principle is enforced at the collector boundary. Plaintext identifiers are normalized, hashed with SHA-256 + a salt rotated every 90 days, and discarded. Only the hash + metadata (source, observation time, severity flags) is persisted.

Verified-ownership dereferencing — for instance, a CISO needing to notify affected employees — is bound to a documented lawful basis (GDPR Art. 6(1)(f) + 34) and is logged for audit. The dereferencing endpoint is rate-limited and tenant-scoped.

N ≥ 5. No exceptions.

Peer benchmarks (the P<value> percentile shown in the report) are computed across a bucket of firms with comparable characteristics: sector, workforce-size band, and revenue band. A benchmark is suppressed if the bucket size falls below five firms.

• ·Bucket definitions are deterministic and published with the methodology version.
• ·Per-client inputs to peer aggregates are hash-blinded; we cannot retrieve which raw value came from which client when computing the bucket statistic.
• ·Outputs to client A are statistically constructed so client A's own contribution cannot be re-identified from the published percentile.
• ·Cross-client raw data is never accessible to any individual client, employee, or analyst.

A heuristic band. Labeled honestly — not a calibrated CI.

Every index output ships with an uncertainty band. We are precise about what it is: a heuristic width (method heuristic-v1) driven by how many sources answered and how fresh the freshest observation is — thin or stale evidence widens the band. It is not a distributional confidence interval and we do not claim a coverage guarantee behind it. Calling it a calibrated confidence interval would overstate the math, so we don't.

For a composite (CXI, MPI) the band is propagated from its components, not recomputed from the number of sources — the composite half-width is the root-sum-of-squares of each component's weighted half-width, so a composite can never read tighter than its widest weighted input. As real observation history accumulates, a calibrated interval will replace the heuristic and the change will be versioned.

RPS = 41.0 [33 – 49]   ← 0–100 scale · heuristic-v1 uncertainty band
        ↑     ↑    ↑
    central lower upper

Individual findings carry caveat tags — the guardrails that separate a defensible number from a raw feed. Four appear across the report:

Every output carries the version it was computed with.

Methodology versions are immutable once shipped. Historical index values are recomputed-only on explicit request and the new values carry both the original version and the recompute version. Clients are notified at least 14 days before any minor version bump and 30 days before any major bump.

What this methodology will never compute.

The collection boundary is part of the math. Outputs are only as trustworthy as the inputs that produced them — these rules bound the inputs.

• ×No authentication bypass. No invite-only forums. No vouched-access communities.
• ×No buying stolen accounts or leaked data 'to validate.' We observe; we do not interact with sellers.
• ×No plaintext PII to clients. Hashes + metadata only.
• ×No cross-client data leakage. Peer benchmarks require N ≥ 5 in a bucket.
• ×No doxxing. No offensive OSINT. No HUMINT. No undercover personas.
• ×Zero tolerance for CSAM. Automated detection → immediate NCMEC report → zero retention.