Vendor & posture health scoring
Alongside questionnaires, Keel can compute a health score for a vendor from signals anyone can observe from the outside — no questionnaire, no credentials, and no AI credits. A questionnaire is point-in-time and self-reported; the health score is observed externally and can be recomputed on demand whenever you want a current read.
Health scoring is generally available: you’ll find a Health & posture panel on every vendor, and a Your posture panel on the Vendors page.
What the score is — and is not
Section titled “What the score is — and is not”The score is a best-effort signal from public checks, not a guarantee and not a penetration test. Because an inflated security score is a liability, the engine is deliberately conservative:
- A signal category Keel could not observe contributes “unknown” and earns no credit — it is never scored as a pass.
- A subject is only rated Strong when every signal category was observed and passed. If any category is unknown, the band is capped at Fair.
- Every point is explained in a plain-language rationale shown in the panel.
The signals
Section titled “The signals”Two categories, each weighted equally. The overall score is the weighted average over the categories that were actually observed (unknown categories drop out and the remaining weight is renormalized).
1. DNS email authentication (SPF / DMARC)
Section titled “1. DNS email authentication (SPF / DMARC)”Read from the domain’s public DNS TXT records over DNS-over-HTTPS:
| Component | Points |
|---|---|
SPF record present (v=spf1) |
+40 |
DMARC record present (v=DMARC1 at _dmarc.<domain>) |
+40 |
DMARC policy p=reject |
+20 |
DMARC policy p=quarantine |
+10 |
DMARC policy p=none (or unspecified) |
+0 |
A full 100 means SPF and DMARC are both published with an enforcing policy. DKIM is reported as “unknown” and does not contribute — see the limits below.
2. CISA KEV exposure
Section titled “2. CISA KEV exposure”A keyword match of the subject’s name and domain against the CISA Known-Exploited- Vulnerabilities catalog Keel already holds:
| Outcome | Points |
|---|---|
| No KEV entry matched | 100 |
| One or more KEV entries matched (by keyword) | 20 |
A match is kept above zero, not zeroed out, because keyword matching produces false positives — 20 flags it clearly while signalling that it needs human confirmation. If the KEV catalog isn’t populated, this category is treated as unknown, not a false “clean”.
The 0–100 score and bands
Section titled “The 0–100 score and bands”| Band | Score | Meaning |
|---|---|---|
| Strong | ≥ 80 | Only when all categories were observed and passing |
| Fair | ≥ 50 | Reasonable, or capped down from Strong because a category was unknown |
| Weak | < 50 | Material gaps observed |
| Unknown | — | Nothing could be observed; the score isn’t meaningful |
Self-posture: score your own domain
Section titled “Self-posture: score your own domain”The Your posture panel on the Vendors page runs the same credential-free checks against your own organization’s claimed domain, so you can see the SPF/DMARC and KEV picture the outside world — a prospect or an auditor — could observe about you, and close gaps before they notice. You’ll need to claim an org domain first (Settings → Workspace).
Running and refreshing a score
Section titled “Running and refreshing a score”Open a vendor (or the Vendors page for self-posture) and use Refresh score. The check runs against public DNS and the KEV catalog on demand and stores the result. Scores are kept as an append-only history so the basis of any score stays auditable.
Precision limits (what’s deferred)
Section titled “Precision limits (what’s deferred)”Keel states these limits plainly rather than overselling the score:
- KEV matching is keyword-based, not version- or CPE-accurate. It matches a vendor/technology name against KEV vendor/product strings and can both over- and under-match. Confirm a match against the subject’s actual products and versions before acting on it. Live NVD/CPE-accurate matching is not yet included.
- DKIM is not evaluated. DKIM keys live at an arbitrary
<selector>._domainkey.<domain>label with no reliable way to enumerate selectors from DNS alone, so DKIM is reported “unknown” and does not affect the score. - No TLS/certificate probe. Certificate expiry, chain, and protocol grading are not part of the score yet.
- No scheduled refresh yet. Scores are recomputed when you press Refresh score; a scheduled/daily automatic refresh is not yet included.
Next steps
Section titled “Next steps”- Vendor risk: build your inventory and review vendors on a cadence.
- Trust Center: show prospects how you manage third-party risk.
- Risk register: roll vendor exposure into your overall risk picture.