SPAT (Security Posture Analysis Tool) is a free, automated external security assessment tool that evaluates the public-facing security posture of a domain from an attacker’s perspective. Developed by Antibody Cyber Technology, LLC, SPAT is designed to give website owners, security engineers, and developers an immediate, actionable view of their most exploitable external weaknesses — without requiring credentials, agent installation, or internal network access.
The primary goal of SPAT is to identify the same configuration weaknesses that opportunistic attackers and automated scanners probe for in the first minutes of reconnaissance: missing encryption enforcement, weak certificate configurations, absent security headers, open high-risk ports, and exposed email authentication gaps. SPAT’s output is structured for both technical and non-technical audiences: a numerical score, a letter grade, and clearly described findings with per-finding remediation guidance.
SPAT does not perform active exploitation, inject payloads, or attempt authenticated access. It is a passive reconnaissance and configuration analysis tool, equivalent to what an external attacker would learn by probing a target domain with publicly available tools before escalating to an active attack phase.
SPAT operates entirely from an external vantage point — no access to the target server’s configuration files, logs, or internal network is required or used. The scanner accepts a bare domain name (e.g. example.com) and performs the following operations in sequence:
robots.txt and evaluate it for sensitive path disclosures. Optionally query VirusTotal’s domain reputation API when threat-intelligence access is configured.All network operations use configurable timeouts to ensure scans complete within a predictable window. Results for each check are classified into one of five severity categories before being aggregated into a final score and grade.
Verifies that the submitted domain resolves correctly in public DNS. When an expected IP is provided, SPAT flags a mismatch as a potential DNS hijacking or misconfiguration issue. A domain that fails to resolve cannot be assessed for any other check and will receive an inconclusive result.
Establishes a TLS connection and inspects the presented certificate for: validity period (not expired, not yet valid), trusted issuer chain (rooted in a well-known CA), hostname match (CN or SAN against the scanned domain), and remaining validity days. Certificates expiring within 30 days generate a HIGH severity warning; expired certificates are CRITICAL.
Probes for support of deprecated TLS versions. TLS 1.0 and TLS 1.1 are formally deprecated by IETF RFC 8996 and removed from all major browsers. Their presence is classified as HIGH severity because they expose connections to BEAST, POODLE-TLS, and related downgrade attacks. SPAT verifies that TLS 1.2 and/or TLS 1.3 is supported as the minimum version.
Evaluates the response headers of the HTTPS response for the following policy headers, each graded independently:
max-age ≥ 31536000 (one year) to be considered strong. Short max-age values are flagged as MEDIUM.unsafe-inline, unsafe-eval, wildcard sources) is MEDIUM.unsafe-url) are flagged as LOW.nosniff to prevent MIME-type confusion attacks. Absence is LOW severity.Verifies that a plain HTTP request to the domain is redirected to HTTPS, and that the redirect uses a 301 (permanent) rather than a 302 (temporary). A missing redirect means that users connecting over HTTP receive no encryption and are not upgraded. This is classified as HIGH severity because SSL stripping attacks remain effective against any domain reachable over plain HTTP.
Probes a targeted list of high-risk ports that are commonly exposed due to misconfiguration or forgotten services: SSH (22), Telnet (23), FTP (21), SMTP (25), database ports (3306 MySQL, 5432 PostgreSQL, 27017 MongoDB, 6379 Redis), RDP (3389), VNC (5900), and SMB (445). Open ports on a public IP are flagged with severity proportional to the service’s exposure risk. Telnet and FTP open to the internet are CRITICAL; SSH open without evidence of restriction is HIGH; database ports open to the internet are CRITICAL.
Fetches and analyzes robots.txt for Disallow: directives that expose sensitive application path structure. Paths containing keywords such as /admin, /backup, /config, /.env, or /api disclose internal architecture to crawlers and reconnaissance tools. These findings are typically LOW or MEDIUM severity.
Queries DNS for SPF (Sender Policy Framework), DMARC (Domain-based Message Authentication, Reporting & Conformance), CAA (Certification Authority Authorization), and DNSSEC signals. Missing SPF and DMARC records enable email spoofing from the domain — a direct enabler of phishing campaigns that impersonate the organization. Missing CAA records allow any CA to issue a certificate for the domain, removing an important defense against misissued certificates.
When VirusTotal access is configured, SPAT queries the domain’s reputation across VirusTotal’s network of antivirus and URL scanning engines. Domains flagged by one or more engines as malicious, phishing, or suspicious receive findings at CRITICAL or HIGH severity. This check adds external corroboration and is particularly valuable when assessing third-party or client domains.
SPAT uses a deduction-based scoring model. Each scan begins at a base score of 100 points. Confirmed findings deduct points according to their severity classification:
| Severity | Point Deduction | Criteria |
|---|---|---|
| CRITICAL | 25 pts | Direct exploitation path with high impact (e.g. database port open, expired cert, Telnet/FTP exposed) |
| HIGH | 12 pts | Significant risk; exploitable by a motivated attacker (e.g. no HTTPS redirect, deprecated TLS, missing CSP) |
| MEDIUM | 6 pts | Notable weakness; reduces defense-in-depth (e.g. missing X-Frame-Options, weak CSP directives) |
| LOW | 2 pts | Best-practice gap; low direct risk but indicative of configuration neglect |
| INFO | 0 pts | Informational finding; no score impact |
Scores translate to letter grades as follows:
| Grade | Score Range | Interpretation |
|---|---|---|
| A | 90 – 100 | Strong security posture; minor or no findings |
| B | 75 – 89 | Good posture with addressable gaps |
| C | 60 – 74 | Moderate risk; several issues require attention |
| D | 50 – 59 | Elevated risk; significant findings present |
| E | 40 – 49 | High risk; multiple serious vulnerabilities |
| F | < 40 | Critical risk; immediate remediation required |
CRITICAL cap: Any domain with one or more unresolved CRITICAL findings has its maximum achievable score capped at 59 (grade D), regardless of the arithmetic sum of deductions. This reflects the principle that a single critical-severity exposure — such as a public database port or an expired certificate — is disqualifying for a strong security grade regardless of how well other controls are configured.
Inconclusive results (scan errors, timeouts, or ambiguous states) are reported separately in the output and do not contribute to the score. This prevents false negatives from inflating the grade on domains where checks could not complete.
The SPAT CLI is an optional cloud-executed command-line extension that adds seven additional checks beyond the 10 performed by the online scanner, for a total of 17 checks (15 external + 2 SSH). It is designed for security engineers and penetration testers conducting deeper external assessments.
CLI-exclusive checks include:
unsafe-inline, unsafe-eval, missing default-src, and base-uri/form-action gaps.Secure, HttpOnly, and SameSite attributes. Missing attributes on session cookies are HIGH severity.* with credentials).CLI report output is generated as a formatted HTML report delivered to the requesting email address. Reports are available for a one-time payment of $4.99 with no subscription required. View a sample CLI report.
SPAT’s check selection is informed by real-world attack patterns documented in CVE databases, OWASP guidance, NIST SP 800-53 control families, and empirical data from penetration testing engagements. The checks prioritize findings that are both commonly present in production environments and directly actionable by a site owner without requiring code changes.
Why external-only? The majority of initial-access techniques used by ransomware groups and opportunistic attackers begin with external reconnaissance. Credentials are not required to identify a misconfigured HTTP redirect, an expired certificate, a missing HSTS header, or an open database port. Limiting SPAT to external checks reflects where the highest-value, lowest-cost improvements for most organizations lie: closing the gaps that any attacker with a browser and a port scanner can find in under five minutes.
Why this check set? Each check in SPAT corresponds to a control requirement in one or more recognized frameworks: HSTS and TLS version checks map to NIST SP 800-52r2 and PCI DSS Requirement 4; CSP and X-Frame-Options map to OWASP ASVS Level 1 requirements; SPF/DMARC checks map to CISA’s Binding Operational Directive 18-01 (for federal agencies) and broadly accepted email security best practices. This framing allows security teams to use SPAT output directly in compliance gap analyses.
Why deduction-based scoring? A deduction model is more intuitive for prioritization than a weighted-average model: organizations can directly calculate the score impact of remediating each finding and build a sequenced remediation roadmap ordered by score impact per engineering effort. The CRITICAL cap ensures that organizations cannot achieve a passing grade by fixing cosmetic LOW findings while ignoring fundamental exposures.
SPAT is an external passive scanner. The following categories of vulnerability are explicitly outside its scope:
SPAT is best used as a continuous monitoring tool and a first-pass assessment baseline — not as a substitute for a comprehensive penetration test. Running SPAT after every significant infrastructure change provides ongoing assurance that security configurations have not regressed.
All scans are performed against publicly reachable services only. SPAT does not attempt to access systems beyond what an unauthenticated external user could reach with standard tools. Scanning a domain you do not own or control requires appropriate authorization. Antibody Cyber Technology, LLC assumes no liability for the use of SPAT findings.