Severity, risk and the security score
What each severity means, how findings are ranked by risk, and how a customer's 0–100 score and A–F grade are calculated.
Updated
On this page
Three numbers describe how bad things are: a finding's severity, its risk score (which orders findings against each other) and the customer's security score and grade.
Severity levels
| Severity | Meaning | Examples |
|---|---|---|
| Critical | Likely to be exploited or already damaging. Act now. | Listed on a ransomware leak site; malware still active on a device; an actively exploited vulnerability on an exposed system |
| High | A serious weakness an attacker can use. Fix this week. | Administrators relying on SMS MFA; Remote Desktop exposed to the internet; no active antivirus |
| Medium | A real weakness that needs other conditions to matter. Plan it. | Windows updates overdue; DMARC not enforced; shared mailboxes that can sign in |
| Low | Hygiene and defence in depth. | Tamper protection off; missing optional security headers |
| Info | Context, never a problem by itself. | A domain mentioned in public code; network ownership |
Severity is always shown with its label, never by colour alone. Findings inferred from a version banner are marked suspected and are never rated critical. See Confirmed, firm and suspected.
Risk score
Every finding also gets a risk score from 0 to 100, used to rank the findings list, Act now and the action plan. It starts from the severity and is adjusted by evidence:
| Factor | Effect |
|---|---|
| Severity (base) | Critical 90, high 70, medium 45, low 20, info 5 |
| On CISA's Known Exploited Vulnerabilities list | +10 |
| EPSS probability | Up to +10 (the EPSS probability × 20, capped at 10) |
| Asset criticality | Critical asset +8, high +4, medium 0, low −5 |
| Confidence | Confirmed +3, firm 0, suspected −8 |
| Internet-facing | +2 |
The result is capped at 0–100. Set an asset's criticality on its page under Attack surface to push findings on important systems up the list. KEV and EPSS are explained in KEV and EPSS.
Security score and grade
Each customer has a security score from 0 to 100 and a grade:
| Grade | Score |
|---|---|
| A | 90 and above |
| B | 80–89 |
| C | 70–79 |
| D | 60–69 |
| F | Below 60 |
How it's calculated
- Open findings only. Findings that are open or in progress count. Resolved, accepted-risk and false-positive findings don't, and neither do findings for controls left out of the customer's ideal state.
- Per category. Findings are grouped into categories (email security, DNS, domain registration, TLS, web application, attack surface, vulnerabilities, identity & access, Microsoft 365, endpoints, network, patch management, dark web & leaks). Only categories that were actually assessed, or have findings, are scored.
- Penalties decay. Each category starts at 100 and loses points per finding (critical 40, high 22, medium 10, low 3, info 0). Each further finding counts a little less than the one before (×0.85), so many small issues can't outweigh one critical one.
- Hygiene is capped. Low and info findings together take at most 8 points off a category, however many hosts repeat them. A customer with only low and info findings stays at an A.
- Weighted average plus the weakest link. Categories are averaged with weights (identity 1.4, attack surface and vulnerabilities 1.3, endpoints, patching and dark web 1.2, network 1.1, email and Microsoft 365 1.0, TLS 0.9, web 0.7, DNS 0.6, domain registration 0.5). The weakest category then pulls the result down: the score is 70% weighted average and 30% weakest category, because attackers go for the weakest area.
- Caps. Any open critical finding caps the score at 55 (an F); any open high finding caps it at 79 (a C).
Risk level
Next to the score, each customer has a risk level summarising its areas: one critical area makes the customer critical, and two areas that need attention (or a grade F) make it high.
Score history
The customer's Overview shows score history, and Change history shows the trend alongside open findings, vulnerabilities, patching and MFA. Scores are re-measured whenever findings change, or when the ideal state changes.