The Brazilian Cyber Exposure Observatory (BCEO): Mapping the Digital Security Posture of Brazilian Municipal Governments

The Brazilian Cyber Exposure Observatory (BCEO) presents a large-scale passive measurement study of cybersecurity posture across Brazilian municipal government websites. The study evaluates 1,000 municipalities using publicly available data sources and passive collection techniques, including DNS resolution, SPF, DKIM and DMARC email authentication records, SSL/TLS certificate validation, HTTPS redirection analysis, HTTP security headers assessment, and technology fingerprinting. To support comparative analysis, this work introduces the Cyber Exposure Index (CEI), a reproducible composite metric designed to quantify digital exposure and security hygiene across multiple dimensions. Key findings include: • 54.2% of sampled municipalities lacked a resolvable government web presence.• 89.3% failed to implement basic HTTP security headers.• 44.1% lacked DMARC email authentication protection.• Only 3.5% satisfied all evaluated security criteria. The project provides an open dataset, methodology, statistical analysis, and source code to support cybersecurity research, digital governance studies, public policy initiatives, and future longitudinal monitoring of municipal cybersecurity in Brazil. Source code and datasets:https://github.com/gugacyber/bceo