What it detects
No TLS switch after STARTTLS negotiation.
Why it fires
Signals a forced downgrade to intercept cleartext.
Worst case
Cleartext eavesdrop · downgrade
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.