Quis custodiet ipsos custodes?

The first failure of every audit.

Once a year, a firm pays a great deal of money for someone to look at its perimeter. The auditor produces a PDF. The PDF goes in a folder. The folder is not opened again until next year. In the months between, the perimeter changes — a forgotten subdomain, a new certificate, an inherited misconfiguration — and the score that was earned at audit time becomes a kind of fossil. It described the past. It says nothing about the present.

This is the first failure: assessments treated as events, not as a standing condition. The world of the perimeter is continuous. The world of the assessment is discrete. The gap between them is where breaches live.

Custodis was built to close that gap.

Scores are earned, not assigned.

Every grade you see on Custodis is computed by a deterministic pipeline of checks. Each check has a written definition, a set severity, and stored evidence. Same asset state, same score. Always. No model judgment, no quarterly recalibration, no auditor adjusting upward because the customer is unhappy with a B.

When your grade moves, you can trace the movement to the exact check, on the exact host, at the exact timestamp. The arithmetic is in the open: a category scores the share of its weighted checks that passed, and a failure weighs severity × age × scope. We will name the finding by its ID. We will keep the evidence behind every verdict.

We are not asking you to trust us. We are showing our work.

No evidence, no claim.

A finding without evidence is a rumour. With every verdict, Custodis stores the evidence the check used to reach it — the SPF record it read, the date a certificate expires, the protocol versions a host accepted, whether a security header was present — and links it to the finding. If we cannot show what we saw, we do not claim it.

This is the second discipline of the order. The first is determinism. The second is provenance. Together they are the only honest answer to the question above the door.

Passive first. Active only with consent.

Discovery begins with public sources — certificate transparency logs, DNS, the things the internet already tells anyone who asks. Beyond that we open a few TLS connections to port 443, ask for the home page and, if you publish an MTA-STS policy, fetch the policy file. Some of the TLS connections offer only outdated protocol versions or cipher suites, which no current browser does, to learn whether the server would still accept them; a server that would not simply refuses. Nothing more touches your servers until you have verified the domain and chosen to enable active checks. Even then: rate-limited, and bounded by what you opted into.

A watchman who breaks down doors is no longer a watchman. He is a thief.