The device score

Every device has a score from 0 to 100 and a grade from A to F. It answers one question: how well does this device meet its customer's ideal state? You see it at the top of the device's page (the ring next to its name) and in the Score column of Devices. Click either for what's affecting it.

How it's calculated

A device starts at 100. Each open issue on it takes points off:

• The most severe issues cost the most. A critical issue (no endpoint protection, an actively exploited vulnerability, an operating system out of support) costs 40 points, a high one 22, a medium one 10 and a low one 3.
• Each further issue costs a little less than the one before it (15% less each time, most severe first). A device with a dozen problems is clearly worse than one with two, but it isn't pushed to zero by sheer numbers.
• Low-severity issues are hygiene. Together they take at most 8 points, so low issues alone never take a device below an A.

This is exactly how RevoSecure scores each area of a customer, so a device's score and its customer's score always agree.

What counts as an issue:

• The device checks: missing or failed updates, a pending restart, protection off, a security tool the baseline expects that is stopped or not installed, an unencrypted disk, operating system support, vulnerable, unsupported or out-of-date applications, and a device that hasn't been seen or hasn't reported for days.
• The device's own open findings: host firewall, SMB and Remote Desktop hardening, SSH, local password policy, Microsoft Defender health and detected malware, macOS protections (System Integrity Protection, Gatekeeper, automatic updates). A finding that is the same problem as a device check is listed once: an unencrypted disk is one issue, not also a BitLocker finding.

One problem, one issue, charged once. Each issue is one thing to fix, with one fix, and costs points once:

• Applications. An out-of-date application is one issue, however many vulnerabilities it has. 1 vulnerable application: Mozilla Firefox lists what's wrong with it underneath (146 critical vulnerabilities, out of date) and is charged once, at the worst of those. With several vulnerable applications it is still one issue that names them ("3 vulnerable applications: Adobe Acrobat, Mozilla Firefox and Google Chrome"); the device's Vulnerabilities tab shows the one version that fixes each.
• Windows updates. Missing updates that fix actively exploited vulnerabilities, updates overdue and updates that failed to install are the same backlog: one issue, the others listed with it.
• Two different fixes are two issues: Windows Firewall off and SMB signing not required, or ThreatLocker stopped and Huntress not installed.

How severe an application issue is:

This is the same rule as Windows updates: a fix a few days old is pending, not overdue.

Minor issues

Some issues are worth doing but never urgent: a pending restart, an application out of date with no known vulnerability, an update that failed but isn't overdue yet (it is retried), operating system support ending in the next months, and low-severity findings. On the device's Overview they are listed apart, under Minor, and each costs a point or two: together they take at most 8 points, so they can never take a device below an A.

Optional extras the agent can do for you, such as disabling the built-in Guest account or setting a screen lock, are not issues at all and cost nothing. They're under Optional hardening and tools, collapsed, below the issues.

An operating system out of support with overdue updates has two issues. The release won't get new security fixes, and the fixes it can still get aren't installed. Installing the overdue updates closes the vulnerabilities they fix but doesn't bring the release back into support, and a device kept patched while its upgrade is planned scores better than a neglected one. Upgrading to a supported release usually fixes both at once (the new release comes with current updates). Leaving one control out of the baseline leaves out only its own issue: excluding operating system support still counts the overdue updates.

What never costs points

• Anything outside the customer's baseline. If a customer's baseline leaves out disk encryption, an unencrypted disk still shows on the device, marked Outside baseline, but it costs nothing. The same goes for every control you exclude, with the reason you gave. See Ideal state.
• Accepted risks and false positives. A finding you accepted or marked as a false positive is no longer open, and this also applies to the device check it stands for. If a device is protected by an antivirus RevoSecure doesn't recognise, mark its "No active antivirus or endpoint protection" finding as a false positive (naming the product): No active endpoint protection still shows on the device, marked False positive, but costs nothing. The same works for disk encryption, operating system support, overdue updates, applications and the expected security tools, on that device only. Reopen the finding and it counts again.
• A security tool the baseline doesn't require. If a tool is installed but its service is stopped, and the customer's baseline doesn't list it among the expected security tools, it still shows on the device (you'll want to know Huntress has stopped), marked Not required, but costs nothing. If that tool was the only thing protecting the device, the device is unprotected, and No active endpoint protection is what counts (its fix names the tool to start). Once the baseline expects the tool, a stopped one counts as a high issue and a missing one as a medium issue: two tools, two fixes.
• Microsoft Defender's real-time protection off while another product protects the device. With real-time protection off, Defender protects nothing, just as if it were switched off. If ThreatLocker (when the baseline counts allowlisting), an EDR or another antivirus protects the device, it shows as Microsoft Defender real-time protection off, marked Not required, and costs nothing: a device mustn't score better by switching Defender off entirely. If nothing protects the device, No active endpoint protection is the issue that counts. If nothing else can be confirmed (for example the software list was cut off), real-time protection being off counts as a medium issue.
• RevoAgent upkeep. "The agent can't update itself", "agent update failed" and "can't install updates on this device" are shown so a technician can fix them, but they don't make the device less secure, so they aren't scored.

Protection is judged the way the customer's baseline says (see Protection): a device running ThreatLocker with Microsoft Defender, or any recognised antivirus or EDR, is protected, and isn't marked down for it.

Baseline changes apply at once. Whether application allowlisting counts as protection and which security tools are expected are judged from what the device last reported, against the customer's baseline as it is now. Change either (in the customer's baseline, or in the template it follows) and the device's protection, issues and score follow straight away, without waiting for its next report. That includes Microsoft Defender's problems that depend on what else protects the device: real-time protection off, and (from older agents) out-of-date signatures, which count only while Defender is the device's only protection. The score you see now is the score the device's next report would give, if nothing on it changes.

Devices that aren't scored

• A new device isn't scored until its first report arrives.
• A removed device isn't scored.
• A disabled device, or one not seen for days, is scored from its last report, and being disabled or out of touch costs points itself. Nobody can vouch for its current state, so it can't keep an A. Bring it back online, or remove it if it was retired.

A device never scores better by going quiet. When its last report is older than the baseline's stale threshold (7 days by default), every problem that report found keeps counting, marked Last report: no endpoint protection, overdue updates, an unencrypted disk (still counted after the encryption check is months old, as long as its finding is open), and the rest. They're re-checked when the device reports again.

Nor does a device score better when a report can't check something: a check that failed to run, Microsoft Defender's status or the installed software that couldn't be read, a software list cut off, an update scan that failed, a Windows release that couldn't be identified. RevoSecure only closes a problem when a report shows it fixed, so the result an earlier report confirmed still counts, marked Earlier report. Hover the tag for when it was last confirmed and what the latest report couldn't check. This applies to endpoint protection, overdue updates, operating system support, disk encryption, and out-of-date and unsupported applications. It is judged against the customer's baseline as it is now: if the device was found unprotected while ThreatLocker was running and the baseline didn't count allowlisting, counting it clears the issue at once. The next report that can check it settles it either way.

Dated problems keep ageing while the device is quiet, exactly as its next report would show them if nothing on it changed. An update missing at the last report is, as far as anyone knows, still missing, so its age keeps counting from its release: an update that was overdue becomes critically overdue on schedule, report or no report. Operating system support ends on its date too: a Windows release whose support ended after the last report shows as out of support.

Reaching an A

Click the score for the breakdown:

• Each issue shows +N: the points fixing that issue on its own would add. Fixing several adds a little more than their sum, because each remaining issue then costs more than it did. The numbers never promise more than a fix delivers.
• The breakdown says the fewest issues to fix for an A, most severe first, and the score that gives. On the device's Overview, those issues are marked For an A.
• When the agent can fix an issue itself, its Fix with agent button is on the issue.
• Each issue links to the tab where you fix it: Updates for missing updates and restarts, Security for firewall and Defender problems, Software for applications, Vulnerabilities for vulnerable software.
• On a device that hasn't reported recently, the path to an A includes its Last report issues: bring the device back online so it reports, then fix what's still wrong. Earlier report issues are the same: find out why the latest report couldn't check them (the tag says), then fix what's still wrong.

If a customer deliberately doesn't do something (for example, desktops in a locked room without disk encryption), record that in the customer's baseline instead of living with a low grade: the device is then measured against what the customer actually wants.

In the device list

• The Score column shows each device's grade; click it for the breakdown without leaving the list.
• Sort by Score to see the weakest devices first. Devices that aren't scored come last.
• The Score filter picks grades (for example D and F), and the Average device score tile shows the average of the scored devices in view; click it to sort lowest first.
• Export CSV includes each device's score and grade.