The OPI Methodology: How DDactic Scores DDoS Resilience 0-100

The OPI (Open Protection Index) is DDactic's measurement of how well an organization's perimeter would withstand a real application-layer DDoS attack. It is not a compliance checklist or a configuration audit. It is a number derived from actual measurements: how many attack paths exist, how severe each one is, and how much of the overall risk surface has been addressed through active defenses.

The score ranges from 0 to 100. A score of 100 does not mean the organization is invulnerable -- it means that every measured attack path has a defense calibrated to stop it before service degradation occurs. In practice, organizations begin assessment with scores in the 30-60 range and reach the 70-90 range after a hardening cycle. The OPI serves as the before/after measurement that justifies the hardening effort.

What Gets Measured

The OPI aggregates scores across six categories, each weighted by its contribution to actual attack success probability. The categories are: API endpoint coverage (do rate limits exist for all significant API paths?), rate limit calibration (are the limits set below the saturation threshold of each endpoint?), TLS and connection layer hardening (are connection-level attacks mitigated?), authentication endpoint protection (are login, registration, and token endpoints specifically protected?), subdomain exposure (are forgotten or shadow APIs included in the protection perimeter?), and configuration verification (do observed defenses match vendor documentation and show evidence of testing?).

Each category produces a sub-score from 0 to 100, weighted by impact. API endpoint coverage and rate limit calibration together account for 50% of the total OPI because they represent the most common attack surface in DDactic's assessment population. TLS and connection layer hardening accounts for 20%, reflecting the high prevalence of connection-exhaustion vulnerabilities in organizations running default server configurations.

How Findings Feed the Score

Each finding from the six-stage scan pipeline is classified by severity (P1 through P4) and mapped to its OPI category. A P1 finding -- an unprotected endpoint with a measured saturation threshold below 100 requests per second -- deducts up to 15 points from the relevant category. A P4 finding -- an informational gap like missing Retry-After headers -- deducts 1-2 points. The severity classification is based on measured data, not theoretical risk: if the saturation threshold is high enough that no realistic attack would reach it, the finding is downgraded accordingly.

Benchmark Context

OPI scores are most meaningful with context. An OPI of 65 in the financial sector is below the median for that sector; the same score in the manufacturing sector is above median. DDactic publishes sector-specific benchmarks based on the anonymized assessment population. The benchmarks allow CISOs to understand their relative position -- not just the absolute score -- and prioritize remediation based on what similar organizations have already addressed.

Reproducibility and Consistency

The OPI is designed to be reproducible: the same environment assessed at different times should produce the same score if nothing has changed. This reproducibility is essential for tracking improvement after a hardening cycle. DDactic achieves this by running assessments from multiple geographically distributed cloud providers (to normalize for network path variance), using deterministic probing sequences, and comparing results against a baseline captured at the start of each assessment. Score changes between assessments are attributed to specific configuration changes, not measurement variance.