How Does Scoring Work?
This page explains, without formulas, how Hunto turns findings into a grade. The arithmetic is on Formula and worked example.
One rating per run
Every time Hunto finishes a discovery run against one of your root domains, that run gets its own rating. A rating is a property of the run: it says what that run saw. The grades you see on Security posture are built from the latest eligible run for each root domain.
A run is eligible to stand for a domain when its target is the root domain itself and it measured at least 60% of the methodology's weight. A narrower run (for example an email-only check) keeps its own rating but does not replace the domain's grade. The domain page tells you when this happens: "This run measures fewer sections, so it has its own rating and does not replace this one."
Sections and weights
The score is made of ten core sections that together are worth 100 points, plus optional module sections.
| Section | Worth |
|---|---|
| DNS & email security | 15 |
| Network exposure | 15 |
| Known vulnerabilities | 15 |
| TLS & certificates | 10 |
| Web security headers | 10 |
| Patching cadence | 10 |
| Breach history (each breach decays over three years) | 10 |
| Leaked credentials | 5 |
| IP reputation | 5 |
| Lookalike domains | 5 |
Module sections belong to the security score only, and only if the module is in your plan: Brand Protection (Brand threats, Data exposure, Takedown effectiveness), Human Risk (Phishing susceptibility, Training completion) and Compliance (Control coverage, Evidence freshness). They are weighted with a module weight that defaults to 1, which you can change in Settings.
From findings to a section score
Each section starts at 100. Every counted finding takes points off, and the more findings, the bigger the deduction, with diminishing effect: the first findings matter most, and a section approaches but never passes its cap. Three things decide how much one finding weighs:
- Severity: critical 10, high 5, medium 2, low 0.5, info 0.
- Confidence in the finding: how sure Hunto is that it is yours. Owned assets count fully (1), attributed 0.8, related 0.6, suspected 0.5.
- Criticality of the asset (security score only, if you switch it on): high 1.5, medium 1, low 0.7.
Larger estates are not punished for being large: the total is scaled by the number of hosts in scope (per ten hosts).
What does not deduct
Some findings are recorded but never lower the score:
- Context findings, such as an inventory fact, or something below a check's relevance floor.
- Findings on a shared network edge (a listed set of content-delivery and large cloud-provider networks) in the Network exposure and Known vulnerabilities sections, because the address may be the provider's rather than yours.
- Findings that Hunto could not place in a section.
- For the standard rating, findings that belong to module sections (they are scored in the security score instead).
The Issues tab lists them as Not counted, each with the reason.
When a finding starts to count
A rating is worked out from one run's results, so everything that run saw and placed in a section counts straight away. There is no waiting for a second sighting. When a later run no longer sees an issue, that later run's rating no longer includes it, and the domain's grade follows the newest eligible run.
For the Security score, findings you or your team have already decided on (fixed, accepted as a risk, or marked not yours) are handled as described in Accepted risk, false positives and what counts.
Not measured, locked, and provisional
- Not measured: no check for the section has run yet, its check failed in the latest run, or (for metric sections) there is no data yet. A not-measured section is left out of the grade. It is not treated as perfect and not held against you.
- Locked ("Not in your plan"): the module is not in your plan, so its sections are not part of your security score.
- Provisional: shown when nothing has been measured yet, or when less than 60% of the weight is measured ("Only N% of the weight is measured (need 60%)"). Hollow points on the History chart are provisional grades.
The overall score is the average of the measured sections, weighted by how much each is worth.
Grades
| Grade | Score |
|---|---|
| A | 90 or more |
| B | 80 to 89 |
| C | 70 to 79 |
| D | 60 to 69 |
| F | below 60 |
Why did my grade get worse after I fixed things?
Usually coverage improved: a check that could not run before has now run and found something that was always there. Open the History tab and expand the rating: New issues and Fixed issues show exactly what moved. See also Nothing found is not the same as we could not look.
The methodology is versioned
The rules above live in a published, versioned methodology ("Hunto standard 2026.1"). Published versions never change. When a new version is published, History flags the affected ratings with "part of the change can be the model, not your posture".
Use cases and wiring tips
- Read the Rating tab first when someone asks "why B and not A?": it lists each section, what it costs, and the top issues behind it.
- Compare the two scores. A large gap between standard rating and security score means your own settings or decisions (accepted risk, weights, criticality, modules) are moving the number. The explanation lists each adjustment and they add up exactly to the difference.
- Track only measured sections when you report upward. A grade built on 60% of the weight is honest but provisional; say so.
- Connect the score to work: Use cases and wiring tips.