Port Exposure
The Port Exposure factor measures how many ports are open and how risky the exposed services are. Single ports are scored by the known risk of their service; multi-port specifications are scored by their breadth or the worst service they contain, whichever is higher.
Default max contribution: 25 points.
Scoring table
Single ports
| Service Risk Level | Points | Examples |
|---|---|---|
| CRITICAL | 18 | Telnet (23), Redis (6379) |
| HIGH | 15 | FTP (21), RDP (3389), SMB (445) |
| MEDIUM | 10 | SSH (22), DNS (53) |
| LOW | 0 | HTTPS (443) |
| Unknown | 3 | No known service match |
Port ranges and lists (2 or more ports)
A multi-port specification scores the higher of two values:
| Breadth | Breadth points |
|---|---|
All ports (1-65535) or any | 25 (max, the whole factor) |
| > 1,000 ports | 22 |
| 101 - 1,000 ports | 18 |
| 11 - 100 ports | 12 |
| 2 - 10 ports | 8 |
| Worst known service in the range | Service points |
|---|---|
| CRITICAL | 18 |
| HIGH | 15 |
| MEDIUM | 10 |
| LOW or none | 0 |
Points = max(breadth points, service points). The factor detail names the highest-risk service, for example 2 ports, highest-risk service: SSH / SFTP 22/TCP (MEDIUM).
Examples (TCP):
| Ports | Breadth | Worst service | Points |
|---|---|---|---|
22,443 | 8 | SSH (MEDIUM) 10 | 10 |
443,8443 | 8 | HTTPS (LOW) 0 | 8 |
3389-3390 | 8 | RDP (HIGH) 15 | 15 |
1-100 | 12 | Telnet (CRITICAL) 18 | 18 |
200-299 | 12 | MEDIUM 10 | 12 |
5000-6000 | 22 | HIGH 15 | 22 |
any | 25 | - | 25 |
Monotonicity guarantee
Widening a port specification never lowers the port points, the port risk level (port_risk in the browser's CSV export) or the final score:
- every multi-port value is at least 8, more than any unknown single port (3);
- the breadth points and the worst-service points can only grow when ports are added;
- a range is never scored below the worst known service it contains (
3389-3390scores the same 15 as3389); - for a multi-port specification, switching TCP or UDP to ANY never lowers the score, because ANY matches every service entry.
Protocol matching
Service lookups are protocol-aware (see Port & Service Database): TCP matches TCP and TCP/UDP entries, UDP matches UDP and TCP/UDP entries, ANY matches all entries. For example TCP/514 is rsh (CRITICAL, 18 points), UDP/514 is Syslog (MEDIUM, 10 points), ANY/514 takes the worse one (18), and UDP/80 is an unknown port (3) because HTTP is a TCP service.
ICMP
When the protocol is ICMP, no port applies. The Port Exposure factor is omitted entirely from the score calculation - only the remaining three factors contribute, so the factor-sum ceiling is 75 (Source 25 + Destination 30 + Zone 20). ICMP counts as a specific port (it is never "all ports"), so an any-to-any ICMP flow floors at 88 through the any-any combo floors.
Custom caps
With a custom portMax in the CLI, the points above are scaled proportionally: round(points x portMax / 25). any ports always score the full custom cap. For example, portMax: 10 turns SSH's 10 points into 4.