VerifiedThreat  UK Index

The VerifiedThreat Index (VTI) is an evaluation tool designed to measure the overall vulnerability level to external cybersecurity threats. Companies should be striving to achieve 100%. The VTI asessement does not introduce deliberate 'Gotacha' to catch people out.  Companies with a comprehensive perimeter Zero Trust policy should be gaining 100%. A score of 80-99% is considered a good score. A par score of 65-79% introduces some meaningful exposure to vulnerabilities. Although clearly not optimal, this category does have largely performing edge protection activated, which may be enough to protect it from more serious attacks. Sites below par or under 65% have more significant failures, and include many sites who score 10 or less which is deemed critical.

The VTI is designed to assess 21 key criteria, from WAF & Firewall operations, to vulnerability to automated traffic, and provides companies with an overall picture of how well their perimeter defence is performing against their peers.

All results derive from non-invasive, controlled simulation activity and do not reflect active breach indicators or confirmed adversarial campaigns. Rather, they reveal the types of exposure that may be exploited through known methods such as bot-based reconnaissance, session hijacking, site impersonation, and unmitigated behavioural simulation.This context is provided solely to inform strategic cybersecurity planning and sectoral hardening.

The VerifiedThreat Index (VTI) reflects exposure-level intelligence derived from the VerifiedThreat telemetry, and real-time digital vulnerability analysis conducted during a monthly 30-day assessment window. The VTI index produces regional and sector aggregated threat data to measure overall performance amongst the relevant peer group.

Although the exact sequence of tests isn’t disclosed to keep the VerifiedThreat Index (VTI) entirely objective, the following represents the types of attack simulation performed. 
‍

• Vulnerability to reconnaissance based attacks using common hacker tools and platforms.
• WAF settings / configuration testing
• Tests common agents in “stealth’ mode that attempt to hide their origins by rotating IP, user agents, and footprints.
• Identifies vulnerable asset protection on login paths, APIs, payment gateways, etc.
• Propensity for fake account creation
• Site Cloning - for high value targets such as banks, financial portals, or major ecommerce sites, where the entire brand is cloned and data mined for access credentials made into the fake site.
• Identifying fake search engine crawlers e.g. fake googlebot
• Cookie Data Integrity / propensity for cookie manipulation & hijacking
• Overall site exposure to automated traffic
• Mitigation bypass techniques for e.g. CAPTCHA.
• Exposure to data mining / API abuse
• Fingerprint / footprint client authentication and blocking