Security Score
Every audit produces a security score — a numeric 0–100 score and letter grade (A+ through F) that summarizes the engagement at a glance. Crucially, the score is coverage-aware: incomplete testing can never produce a stronger grade than the evidence supports.How it’s calculated
The score starts at 100 and deducts for reportable findings. The deduction for each finding depends on four factors: 1. Severity base deduction
2. Verification confidence — a
verified finding deducts at full weight; an unverified one deducts at 25% until it’s independently confirmed.
3. Exploit class — confirmed exploit findings deduct 15% more than exposures or misconfigurations.
4. Diminishing repetition — repeated findings of the same severity deduct with diminishing weight (1/√rank), so twenty missing-header variants don’t swamp one real RCE — but every additional real finding still affects the score.
Coverage notes, security controls, and inventory records never reduce the finding-derived risk score.
The coverage ceiling
The final score cannot exceed the audit’s measured methodology coverage. If the engagement completed 80% of its planned techniques, the score is capped at 80 — even with zero findings. Partial results (timed out, cancelled, or ended early) are additionally capped at 69. This is deliberate: a scanner that runs for 5 minutes and finds nothing should not report an A+.Grade bands
What you see
Every audit exposes the full breakdown, so the grade is never a black box:What the score is and isn’t
The score is good for:- One-line summaries in dashboards, Slack notifications, and reports
- Trend tracking across recurring audits
- Risk-tier classification across many apps
- A substitute for reading the findings
- A measure of total risk (one critical finding can be catastrophic regardless of score)
- Comparable across apps with very different surfaces
Tracking over time
The app dashboard plots score across audits. Use it to verify remediation progress sprint over sprint and to detect regressions when new releases introduce findings.Next steps
Findings & Evidence
The inputs to the score.
Reports
Where the breakdown appears.