Accepted Risk, False Positives, Coverage and Recompute
Your decisions about findings change your Security score. They never change your Standard rating. This page explains which decisions count, how coverage affects a grade, and when scores are refreshed.
Which decisions change the score
Set the status of the detection that carries the finding. The next time your security score is calculated, the finding is treated like this:
| Status you set | In the Security score | In the Standard rating |
|---|---|---|
| Accepted risk | Not counted. The Issues tab says "accepted risk". | Still counted |
| False positive | Not counted: "excluded (not ours / false positive)" | Still counted |
| Whitelisted | Not counted: excluded, as above | Still counted |
| Resolved | Not counted: "resolved" | Still counted |
| Any open status (detected, verified, in progress, on hold and so on) | Counted | Counted |
Why the split? The standard rating is how anyone looking you up from outside would see you. They cannot see your internal decisions, so the rating does not use them. The security score reflects how you manage risk.
Note: a finding that is still seen by the next run stays in the standard rating until it is truly gone. Marking it "resolved" does not fix it for outside observers.
See what your decisions are worth
On Rating, the security score's formula panel lists the personalisation lines. Each line has its own points, and together they add up exactly to the gap between the two scores. The lines that come from decisions are:
- Your corrections (not ours, false positive, resolved)
- Accepted risk
Other lines come from your settings: section weights, module weights and asset criticality. See Settings and personalisation and The "How is this calculated?" panel.
Tip: if your accepted risks add up to a large share of the gap, review them. Filter Issues by Not counted and the Status facet to see what is currently excluded.
Asset criticality
If Asset criticality is on in Settings, a finding on a critical asset costs more: high 1.5, medium 1, low 0.7 times its normal weight. Set the level on each asset in All Assets. This applies to the security score only.
Coverage: what makes a grade provisional
A grade is only as complete as the checks behind it. Each section is one of:
- Measured: a check ran and its result is in the grade.
- Not measured: no check for this section has run, its check failed in the latest run, or there is no data yet. It is left out, not treated as perfect.
- Locked ("Not in your plan"): the module is not in your plan.
If nothing has been measured, or less than 60% of the weight has been ("Only N% of the weight is measured (need 60%)"), the grade is provisional. It is drawn hollow on History and marked on the badge.
A run also has to measure at least 60% of the weight to stand for a domain at all. A narrow run keeps its own rating and does not replace the domain's grade. See Domain rating, run rating and Rate now.
To improve coverage, run a rating that includes the missing checks (the Not checked list in the explanation pane names each one and gives the reason).
When scores are refreshed
| Event | What happens |
|---|---|
| A discovery run against one of your root domains finishes | That run is rated. The standard rating and security score are recomputed from the latest eligible run per domain. |
| You press Recompute now | Both scores are recomputed from the runs that already exist. It does not start a new run. |
| You save Settings | The security score is recomputed ("Saved. The security score was recomputed.") |
| You change a detection status | Picked up by the next recompute. Press Recompute now to see it at once. |
| A new methodology version is published | Ratings calculated from then on use the new version. History flags the change. |
Note: Recompute now is for decisions and settings. To prove a fix, you need a new run that no longer sees the issue.
Common questions
I accepted a risk, but my standard rating did not move. That is expected. Look at the security score.
I marked a finding as a false positive but it still shows in Issues. Open Not counted. It is listed there with its reason. It is not deleted, so you can review the decision.
The score changed although I did nothing. Open History and expand the newest rating. See History and rating changes.
Use cases and wiring tips
- Review accepted risk quarterly: filter Issues by Not counted, then check each accepted item's date and owner. Reopen anything that no longer holds.
- Board reporting: quote the standard rating for comparison with peers, and the security score for how you manage. Explain the gap with the personalisation lines.
- Vendor onboarding gate: use the standard rating, since it ignores your own decisions. See Use cases and wiring tips.
- Detections and incidents: statuses come from the same workflow your analysts already use. No separate approval is needed in Scoring.