How each exposure index
is actually computed.

What the methodology commits to before any individual index.

One headline number, then each index it rolls up.

CXI = Σ_i  w_i · normalize(index_i)     i ∈ {CES, IMI, RPS, BLV, BIR}

CES_window = N_new_creds + β · N_high_severity_creds

IMI_window = Σ_listing severity_l · reputation_l · recency_l

RPS = w₁ · direct_mention + w₂ · supplier_overlap + w₃ · cohort_clustering

BLV = (Δ_new_artifacts / Δt) · severity_weight · audience_weight

BIR_window = Σ_d log₁₀(estimated_traffic_d + 1)

Enumerated. Contractual.

The sources we collect from are part of the contract. Adding a source requires a methodology version bump and a notice to existing clients. Removing a source likewise. Source weights are reviewed quarterly.

Hashed at ingest. Dereferencing requires verified ownership.

The minimum-necessary principle is enforced at the collector boundary. Plaintext identifiers are normalized, hashed with SHA-256 + a salt rotated every 90 days, and discarded. Only the hash + metadata (source, observation time, severity flags) is persisted.

Verified-ownership dereferencing — for instance, a CISO needing to notify affected employees — is bound to a documented lawful basis (GDPR Art. 6(1)(f) + 34) and is logged for audit. The dereferencing endpoint is rate-limited and tenant-scoped.

N ≥ 5. No exceptions.

Peer benchmarks (the P<value> percentile shown in client dashboards) are computed across a bucket of firms with comparable characteristics: sector, workforce-size band, and revenue band. A benchmark is suppressed if the bucket size falls below five firms.

• ·Bucket definitions are deterministic and published with the methodology version.
• ·Per-client inputs to peer aggregates are hash-blinded; we cannot retrieve which raw value came from which client when computing the bucket statistic.
• ·Outputs to client A are statistically constructed so client A's own contribution cannot be re-identified from the published percentile.
• ·Cross-client raw data is never accessible to any individual client, employee, or analyst.

80% bands. Bayesian shrinkage on small-N.

Every index output ships with an 80% confidence interval. We chose 80% (not the more familiar 95%) deliberately — at 95%, intervals on small observation windows become uninformative wide bands that disguise real signal. 80% balances calibration with usability.

For clients with thin observation history (< 14 days) or narrow attack surfaces, we apply Bayesian shrinkage toward the peer-cohort prior. The prior is the cohort median with conservative weighting; the shrinkage weight is published alongside each affected output. As your observed data accumulates, the shrinkage decays automatically.

RPS = 7.2 [6.7 – 7.6]   ← 80% CI
       ↑    ↑     ↑
   central lower upper

Every output carries the version it was computed with.

Methodology versions are immutable once shipped. Historical index values are recomputed-only on explicit request and the new values carry both the original version and the recompute version. Clients are notified at least 14 days before any minor version bump and 30 days before any major bump.

What this methodology will never compute.

The collection boundary is part of the math. Outputs are only as trustworthy as the inputs that produced them — these rules bound the inputs.

• ×No authentication bypass. No invite-only forums. No vouched-access communities.
• ×No buying stolen accounts or leaked data 'to validate.' We observe; we do not interact with sellers.
• ×No plaintext PII to clients. Hashes + metadata only.
• ×No cross-client data leakage. Peer benchmarks require N ≥ 5 in a bucket.
• ×No doxxing. No offensive OSINT. No HUMINT. No undercover personas.
• ×Zero tolerance for CSAM. Automated detection → immediate NCMEC report → zero retention.