Post-exploit response score
A operational history factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor is a curator-assigned score from 1 to 5 evaluating the protocol's response to its most recent incident across four dimensions: user compensation (restitution offered and delivered), transparency (public communication timeliness and completeness), root-cause depth (post-mortem technical precision), and operational recovery (time to restore normal function). A score of 5 represents exemplary response on all four dimensions; a score of 1 represents silence or denial.
Why it matters
Post-exploit response quality is a leading indicator of whether a future incident will be handled well. Protocols that respond poorly -- by going silent, providing vague post-mortems, or failing to compensate affected users -- demonstrate governance and operational cultures that increase systemic risk. In contrast, protocols that publish detailed post-mortems within thirty days, offer structured compensation, and commission re-audits signal that security is treated as a continuous process rather than a one-time checkbox. The dataset shows consistent correlation between poor response scores and subsequent second exploits.
Green / Yellow / Red
Green: score of 4 or 5, indicating timely public communication, full root-cause disclosure, meaningful compensation effort, and rapid operational recovery. Yellow: score of 2 or 3, indicating partial disclosure, delayed communication, or incomplete compensation. Red: score of 1, indicating silence, denial, or team abandonment following the incident.
Common gray cases
For protocols with multiple incidents, this score applies to the most recent incident only. If the most recent incident is ongoing (fewer than thirty days elapsed) and no post-mortem has been published, the field is marked gray pending curator assessment.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Curator-score (1–5) the most recent incident response on: compensation completeness, transparency of disclosure, root-cause analysis depth, and operational recovery speed.