St. Louis Cyber Exposure Index

The St. Louis Cyber Exposure Index is a BirdyFoot resource that measures how exposed the region is to cyber attack. Every quarter, automated tooling checks 500 anonymized St. Louis companies using only information that is already public. BirdyFoot analysts review the findings and turn them into one report for the region.

Think of the findings as low-hanging fruit. Each one takes an attacker little effort to find or use, yet it can put a business, its people, and its customers at serious risk.

We do this work so the community can see where it stands and act before a weakness becomes a breach. Together, we can build a safer St. Louis.

Attackers start from the outside, so the index does too. Each of the 500 companies is checked on 5 signals, in the order an attacker would try them, using nothing the open internet does not already show. No logins are attempted and no test messages are sent.

The first is email spoofing protectionWhat an attacker doesSends invoices and password resets that look like they came from you., because a forged invoice or password reset is the cheapest attack there is. Next come website encryptionWhat an attacker doesReads or alters what visitors and staff send to your site., visible outdated softwareWhat an attacker doesRuns a published exploit against the version you advertise., and exposed login portalsWhat an attacker doesTries leaked passwords against a door you left on the map.: the doors a single scan of a domain turns up. Last are basic security headersWhat an attacker doesInjects scripts or frames your site inside a phishing page., which decide how much a browser will protect visitors from a tampered page.

Every signal lands in one of three tiers, worth 0, 50, or 100 exposure points. The 5 signals weigh the same, so a company’s score is a plain average from 0 to 100, and higher means more exposed. Companies average into their sector and sectors into the region, which gives St. Louis one number each quarter.

Because every step is automated and repeatable, a change in the score means something changed, not that we looked differently.