What QFinch tests—and what it does not.
Public previews use bounded, non-invasive observations. Detailed findings and active assessments require verified property ownership.
Public preview
TLS, redirect, response-header, cookie, and limited publicly served technology signals. No form submission, authentication, exploitation, fuzzing, or arbitrary port scanning.
QFinch Exploit Risk v1
The 0–100 score prioritizes evidence of weaponization, exploitation probability, and technical impact. Metasploit availability contributes 40 points, CISA KEV 25, Exploit-DB 20, EPSS up to 25, and CVSS impact up to 20; the total is capped at 100. Bands are Low (0–29), Medium (30–59), High (60–79), and Critical (80–100).
This score does not replace CVSS or predict impact for a specific asset. CVSS, EPSS, KEV, source provenance, and the QFinch calculation remain visible as separate signals.