Custodis continuously surveys your internet-facing estate, grades it A–F across eight risk categories, and shows you exactly why — check by check, asset by asset.
Passive discovery: certificate transparency logs, DNS. We map every subdomain, certificate, and service you forgot you had — without touching your servers.
A documented pipeline of checks — TLS, DNS, mail, headers — each with a defined severity and penalty. Deterministic, reproducible, no black box.
Findings with evidence, a 0–900 score with full history, and alerts when something changes in the night.
No vibes, no vendor magic. Each failing check contributes a penalty you can audit down to the arithmetic:
| Check | Sev | Math | Penalty | |
|---|---|---|---|---|
| 1 | ENC-001 · TLS 1.0 supported | HIGH | 6 × 1.13 × 3.00 | −20.4 |
| 2 | DNS-004 · DMARC policy "none" | MED | 3 × 1.27 × 1.00 | −3.8 |
| 3 | APP-001 · Missing CSP header | MED | 3 × 1.05 × 2.32 | −7.3 |
Scores on Custodis are never assigned by hand, estimated by a model, or adjusted for commercial convenience. They are computed — by a documented pipeline of checks, each with a written definition, a fixed penalty, and stored evidence.
When your grade moves, you can trace the movement to the exact check, on the exact host, at the exact timestamp. That is the whole product.
| Point-in-time auditthe old way | Custodisthe standing watch | |
|---|---|---|
| Cadence | Once a year, then silence | Continuous — change detected in under 24 hours |
| Coverage | The assets you remembered to declare | Every subdomain & certificate, discovered passively |
| Scoring | Auditor judgment, opaque | Deterministic checks with published penalty math |
| Regressions | Found at the next audit | Re-opened automatically, original date preserved |
| Pricing | "Contact sales" | Transparent monthly tiers, 14-day trial, no card |
