Methodology
Version 2026.1. Any change to sources, categories, weights or the formula creates a new version, and snapshots record the version used.
What the index measures
The CybRes Media & Disclosure Signal Index summarises how often, how seriously and how recently cyber and digital risk events involving a company appear in public sources. It runs from 0 (no adverse signal) to 100. It is not a security rating, an audit, a credit opinion or investment advice, and it says nothing direct about the quality of a company's internal controls. A well-run company that discloses openly can show more signals than a less transparent one.
Sources
- News: public headlines and snippets retrieved through a commercial search API (SerpApi or Serper.dev), searching India-edition news for the company name with cyber, outage, fraud and regulatory terms over the last 12 months.
- Disclosures: BRSR Principle 9 figures (consumer complaints on data privacy and cyber security, and data breach instances), exchange filings and annual reports. Discovered documents count only after an analyst verifies the figures.
- Advisories: CERT-In advisories and vulnerability notes, mapped to sectors. Shown for context; never scored against a company.
- Passive hygiene checks: TLS certificate, HTTPS redirect, security headers, SPF and DMARC on a company's primary public domain. These read only what any browser or mail server sees. Shown separately; not part of the index.
CybRes does not scan ports, probe applications, attempt logins, buy breached data or use any non-public source.
Classification
Each news item is classified by an AI model (OpenAI) instructed to judge only from the headline and snippet, to mark items unrelated unless the event involves the named company, and to prefer lower severity when unsure. If the model is unavailable, a transparent keyword classifier assigns low severity. Automated items are labelled "Automated, unreviewed" until a CybRes analyst confirms, edits or rejects them.
| Category | Definition | Weight |
|---|---|---|
| Data breach | Confirmed or credibly reported unauthorised access to customer, employee or business data. | 1.0 |
| Ransomware | Ransomware or extortion attack affecting the company or its operations. | 1.0 |
| Cyber attack | Intrusion, hacking, DDoS, malware or account takeover targeting the company. | 0.9 |
| Data exposure | Data found exposed publicly (misconfigured storage, leak on forums) without confirmed attack. | 0.8 |
| Regulatory action | Penalty, direction or restriction by RBI, SEBI, IRDAI, CERT-In, DPB or courts linked to IT, cyber or data protection. | 0.8 |
| Digital outage | Material disruption of digital services (apps, payments, online banking, IT systems). | 0.6 |
| Third-party incident | Incident at a vendor or partner that affected the company or its customers. | 0.6 |
| Digital fraud | Phishing, impersonation or online fraud exploiting the company's brand, platform or customers. | 0.5 |
| Vulnerability | Publicly disclosed security flaw in the company's product, app or system. | 0.4 |
| Security governance (positive) | Security investment, certification or governance news. Shown for context; not scored. | 0.0 |
| Not relevant | Not about a cyber or digital risk event involving this company. Excluded. | 0.0 |
Severity
- 1 — Minor: limited, quickly resolved, little customer impact
- 2 — Low: some disruption or small data set; contained
- 3 — Moderate: notable customer impact or regulatory interest
- 4 — High: large data set, extended outage, or regulatory action
- 5 — Severe: systemic impact, very large breach, or business restriction
Formula
For each counted signal: points = weight × severity/5 × relevance × 0.5age in days / 90.
Verified filings reporting data breaches add 0.5 × min(breaches, 3)/3, decayed from the fiscal year end.
The index is 100 × (1 − e−S / 1.5), where S is the sum of points. This keeps the index between 0 and 100 and stops a single company with many minor stories from dominating.
A signal is counted only if its relevance is at least 0.5, its category carries weight, it has not been rejected, and it was published in the last 365 days. Near-identical syndicated headlines are merged.
Bands: 0 none · under 30 low · 30–59 elevated · 60+ high. Bands describe the volume of public signal, not the probability of an incident.
Known limitations
- Press coverage varies by company size and sector; compare a company with its sector peers.
- Headlines can be inaccurate or later corrected; we link to every source so readers can judge.
- Search APIs do not return every article. Absence of signal is not evidence of good security.
- Companies with similar names can be confused; analysts review and reject such items.
Corrections and right of reply
Anyone, including the company concerned, can request a correction. Requests and outcomes are logged publicly with dates. See also our independence policy.