How Does Scoring Work?
How Does Scoring Work?
The platform looks at all of an organization's security detections and produces a single number from 0 to 100 that represents their overall security health.
- 100 = Perfect — nothing detected
- 0 = Worst possible — overwhelmed by threats
- Most organizations fall somewhere in the 50–85 range
Three Areas of Security
The score is split into three modules, each looking at a different type of risk:
| Module | What It Watches | Examples |
|---|---|---|
| Attack Surface (ASM) | Technical infrastructure risks | Unpatched vulnerabilities, exposed ports, unknown subdomains |
| Brand Protection (BP) | Brand abuse and stolen data | Phishing sites, dark web leaks, fake social accounts, BIN leaks |
| General Detection | Unclassified items in the queue | New detections waiting to be sorted into ASM or BP |
Each module gets its own score. These are combined using weights (set by the admin) to create the overall score.
Example: If ASM has weight 40%, BP has 35%, and Detection has 25%, then ASM has the biggest influence on the overall score.
What Makes the Score Go Up or Down
Score Goes Up (Improving) When:
- Threats are resolved (phishing sites taken down, vulnerabilities patched)
- Takedowns succeed (for brand protection)
- The resolution rate increases (team is closing items faster than they arrive)
- Detections are marked as false positives (they weren't real threats)
Score Goes Down (Worsening) When:
- New threats appear (new phishing sites, new vulnerabilities)
- High-severity items are detected (critical/urgent items weigh more)
- Items sit unresolved for a long time (age factor increases)
- Scoring rules trigger (custom conditions that add extra risk)
Not All Threats Are Equal
The system assigns different weights based on severity:
| How Dangerous | Weight | Impact on Score |
|---|---|---|
| Urgent / Phishing | Highest (×10) | Biggest drop in score |
| Critical / Dark Web / Leaked Credentials | High (×8) | Large drop |
| High severity / BIN Leaks | Medium (×5–6) | Moderate drop |
| Medium severity / Scams | Lower (×2–5) | Smaller drop |
| Low severity / Counterfeit | Lowest (×0.5–3) | Minimal drop |
Key takeaway for customers: Resolving a single phishing site improves the score more than resolving several low-severity items.
Organization Size Matters
The system is volume-aware. The same 5 phishing sites will affect a small organization's score more than a large enterprise's score.
Why? If you have 10 total detections and 5 are phishing, that's 50% of your landscape — very concerning. If you have 10,000 total detections and 5 are phishing, that's a tiny fraction — still bad, but proportionally less impactful.
This means:
- Small orgs see larger score swings from individual detections
- Large orgs need more detections to move the needle
- The score is always fair relative to the organization's size
Takedown Effect (Brand Protection)
For Brand Protection, successful takedowns directly improve the score. The system tracks the takedown success rate and uses it as a dampener:
- 0% takedown rate → Full risk applies
- 50% takedown rate → Risk reduced by 25%
- 100% takedown rate → Risk reduced by 50%
So even with active threats, a strong takedown program makes a visible difference.
Rules Add Extra Risk
Admins can create scoring rules — conditions that add extra risk when triggered. For example:
"If there are more than 5 critical vulnerabilities, add 80 points of risk"
This makes the score drop more aggressively for situations the organization considers especially dangerous. Rules are shown as "Rule Boost" in the module detail panel.
Score Refresh
Scores are computed periodically (on a schedule) and can also be triggered manually with the "Run Scoring" button. Each computation creates a snapshot — a point-in-time record of all scores, which is how the history charts get their data.
Quick Reference for Customer Conversations
| Customer Asks | Your Answer |
|---|---|
| "Why did my score drop?" | Check the module detail panel — look at which variables increased or which rules triggered |
| "How do I improve my score?" | Resolve high-severity detections first, especially phishing and critical vulnerabilities |
| "Why is my score different from last week?" | Open the Score History chart to see the trend; check for new detections or resolved items |
| "Can I change how the score is calculated?" | Yes — module weights, formulas, and rules are all configurable in the Risk Configuration page |
| "What's a good score?" | 80+ is good, 90+ is excellent. Most organizations are in the 50–85 range |
| "Why does my competitor have a better score with more threats?" | The score is volume-aware — larger organizations naturally have a higher tolerance threshold |