Front Door 9: your institution vs the India BFSI 125
Not one of India’s 125 banks, insurers and market institutions passes all nine checks an outsider can run on its front door — the best pass 7. See where yours stands, with the forensic evidence behind every reading.
Why now
Three headline flaws in one week. Eight eMudhra intermediate certificate keys turned out to be recoverable, and browsers blocked them between 17 and 20 October. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and HTTP2Shell (CVE-2026-111497, in the Brotli decoder) were both fixed on 21 October.
Only the first can be seen from outside. The report tests every certificate in your chain for the eMudhra flaw. PHP and Brotli versions sit inside your estate: check those with your own teams.
What the report contains
- An executive summary: your Front Door 9 result, where you stand against your peers and all 125, and this week’s headlines.
- A page per check — what we read, why it matters, what to do — with the sector’s pass rate beside it.
- A forensic annexure: every observation, read twice by independent methods, each with its own IST timestamp.
The Front Door 9
- Trust: a trust chain clear of the compromised eMudhra keys, a valid certificate, a certificate inside the 100-day limit that applies from 15 March 2027, and CAA.
- Resilience: post-quantum key exchange and DNSSEC.
- Exposure: security.txt, an enforcing DMARC policy, and web application security (CSP).
On 25 October 2026, none of the 125 institutions passed all nine, and only 8% already served a certificate inside the 100-day limit. Your percentile is taken on all nine, against how many of the 125 pass each number of checks.
If your firewall refuses our reader
We read as ourselves, never disguised as a browser. Our reader sends the user agent Mozilla/5.0 (compatible; BitScoreExposureCheck/1.0; +https://www.bitscore.in/tools/check-your-domain). If your bot management refuses it, the report says so — that is a control working — and the check shows as not read, never failed. To have it graded, allow that user agent and reply to the email your report came with: we re-read with your consent.
Who can ask for it
CISOs, CIOs, CTOs, CROs, CEOs and MDs, executive directors, and board or IT Strategy Committee members. The report reads the domain your work address is on — or, for India’s listed banks, insurers and market institutions, your institution’s website — and is issued only after a one-time code confirms the address.
Financial institutions receive their report personally from Nimitt Jhaveri within one working day. Other companies get theirs straight away.
What it is not
It is not a security rating, and not a Bitsight rating. It reads your website’s TLS handshakes, one homepage request and public DNS records. For your full external footprint, ask for the complimentary Cyber Risk Rating Report. The method and sector figures are on the India BFSI Readiness Index page.