How the grade is calculated
KOLLEN combines three areas: mail, DNS and web. Mail covers SPF, DKIM and DMARC. DNS covers how your domain is set up, for example DNSSEC and name servers. Web covers certificates and how your website responds.
Each area is scored and weighted into a single grade from A to F. A means most things are in place, F means several basic protections are missing.
What drags it down most
Missing or weak DMARC drags the grade down clearly, because it opens the door to spoofed mail in your name. An expired or invalid TLS certificate on the web also weighs heavily, as visitors are met with warnings.
If your domain or mail server is on a blocklist, for example Spamhaus, the grade drops sharply. It often means your mail is already bouncing at recipients.
The grade measures what is visible from the outside
KOLLEN looks from the outside, the same way anyone on the internet can. The grade therefore reflects the picture an outsider gets of you, not what happens inside your systems.
That is a strength, because it is exactly what the outside sees that attackers and customers judge you on. But it also means a good grade does not tell the whole story about your internal security.
Separate from PIANOLA's Risk index
The KOLLEN grade should not be confused with the Risk index in PIANOLA. The grade is based on what is visible from the outside without logging in. The Risk index is based on a deeper assessment from inside your Microsoft 365 environment, covering permissions, policies and settings.
They complement each other. Start with KOLLEN to see the outside. If you want the full picture from the inside, PIANOLA is the next step.