Confluent Asset Management
Public Cybersecurity Posture & Verification Assessment
📋 Executive Summary & Status Classification
Public Assessment Finding
Reported unsupported server-side software (PHP 8.1.34 observed via HTTP header disclosure; PHP 8.1 reached EOL Dec 31, 2025). Underlying server configuration and current remediation status have not been independently confirmed. Narrow technical website finding, not an assessment of broader cybersecurity or client data custody.
Observation Category: Website Maintenance — Remediation Unverified | Headers Evaluation: F
Our transparency network monitors whether businesses implement foundational defenses necessary to withstand commodity credential spraying, phishing campaigns, and man-in-the-middle attacks.
🎯 Operational Assurance & Governance Evaluation
Factual Basis: Website Maintenance: On October 21, 2026, USTech.Ninja notified Confluent Asset Management (Nicholas Chavez) that its website appeared to disclose PHP 8.1.34, an unsupported release. Underlying server configuration and current remediation status have not been independently confirmed.
Methodology Note: Operational Assurance evaluates observable organizational conduct, notification responsiveness, and documented governance processes independently from technical baseline scores. It is not an assessment of personal character, motive, or health.
🛡️ Observed Technical Controls
HTTP Security Headers F
HTTP response headers instruct browsers how to handle sensitive user sessions, external scripts, and iframe rendering. Gap Observed: Missing HSTS, Content-Security-Policy, or X-Frame-Options headers leaves visitors vulnerable to clickjacking and protocol downgrade.
Email Defense (SPF/DKIM/DMARC) Public Check
Domain-level DNS records prevent unauthorized adversaries from impersonating company staff in outbound phishing attacks. Public Record: Outbound domains without strict DMARC rejection policies remain susceptible to spoofed email delivery.
Transport Encryption (HTTPS) Active
Valid SSL/TLS certificate configured on confluentam.com for secure user communications.
All public web traffic is routed over TLS.
The Standard (8 Core Controls) Unconfirmed
Evaluates 8 fundamental protections: Managed EDR, Hardware MFA, Air-gapped Backups, Patch Automation, DNS Filtering, Privilege Separation, Incident Response, and Encryption.
⚖️ Scope Limitations & Assessment Methodology
This transparency report represents an external, non-invasive observation of publicly visible domain settings, DNS records, and HTTP headers as of Oct 2026.
- What this establishes: An objective record of publicly detectable web and mail configurations against standard cyber hygiene benchmarks.
- What this does NOT establish: A public finding does not imply that an internal network breach has occurred, nor does it establish active exploitation. Conversely, lack of a public finding does not guarantee immunity from zero-day threats.