Post-exploit response score
A operational history factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor is a curator-assigned score from 1 to 5 evaluating the protocol's response to its most recent incident across four dimensions: user compensation (restitution offered and delivered), transparency (public communication timeliness and completeness), root-cause depth (post-mortem technical precision), and operational recovery (time to restore normal function). A score of 5 represents exemplary response on all four dimensions; a score of 1 represents silence or denial.
**Why it matters** Post-exploit response quality is a leading indicator of whether a future incident will be handled well. Protocols that respond poorly -- by going silent, providing vague post-mortems, or failing to compensate affected users -- demonstrate governance and operational cultures that increase systemic risk. In contrast, protocols that publish detailed post-mortems within thirty days, offer structured compensation, and commission re-audits signal that security is treated as a continuous process rather than a one-time checkbox. The dataset shows consistent correlation between poor response scores and subsequent second exploits.
**Green / Yellow / Red** Green: score of 4 or 5, indicating timely public communication, full root-cause disclosure, meaningful compensation effort, and rapid operational recovery. Yellow: score of 2 or 3, indicating partial disclosure, delayed communication, or incomplete compensation. Red: score of 1, indicating silence, denial, or team abandonment following the incident.
**Common gray cases** For protocols with multiple incidents, this score applies to the most recent incident only. If the most recent incident is ongoing (fewer than thirty days elapsed) and no post-mortem has been published, the field is marked gray pending curator assessment.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Curator-score (1–5) the most recent incident response on: compensation completeness, transparency of disclosure, root-cause analysis depth, and operational recovery speed.