Formula and Variables
This page gives the exact calculation behind every grade, using the published methodology ("Hunto standard 2026.1"). You never have to do this by hand: the "How is this calculated?" panel shows the same numbers for your own data.
The steps
- Load per finding. For each counted finding,
load = severity weight × confidence × criticality multiplier.- Severity weights: critical 10, high 5, medium 2, low 0.5, info 0.
- Confidence: 1 for owned, 0.8 attributed, 0.6 related, 0.5 suspected (0.8 when unknown).
- Criticality multiplier: high 1.5, medium 1, low 0.7. Used only in the security score, and only if "Use asset criticality" is on. The standard rating uses 1.
- Add up a section.
Lis the sum of loads in the section. - Scale for size.
L_norm = L / max(1, hosts ÷ 10), where hosts is the number of hosts in scope. A hundred hosts and a hundred findings weighs the same as ten hosts and ten findings. - Turn load into a deduction.
deduction = cap × L_norm ÷ (L_norm + k). The cap is 100 for every core section;kis a per-section constant that says how quickly the section drops. - Section score.
100 − deduction. - Overall score. The weighted average of measured sections only. Sections that are not measured or locked are left out of both the numerator and the total weight.
- Grade. The score is compared with the grade bands (A 90, B 80, C 70, D 60, else F).
Metric sections (for example Phishing susceptibility and Takedown effectiveness) do not use findings. They read a metric (such as your human-risk score, or a takedown percentage) and convert it to a section score along a fixed curve.
Section constants
| Section | Worth | k |
|---|---|---|
| DNS & email security | 15 | 8 |
| Network exposure | 15 | 10 |
| Known vulnerabilities | 15 | 10 |
| TLS & certificates | 10 | 6 |
| Web security headers | 10 | 8 |
| Patching cadence | 10 | 8 |
| Breach history | 10 | 5 |
| Leaked credentials | 5 | 6 |
| IP reputation | 5 | 3 |
| Lookalike domains | 5 | 6 |
| Brand threats (module) | 10 | 6 |
| Data exposure (module) | 5 | 6 |
Severity when a check gives only a number
When a check reports a 0-100 result instead of a severity, it is mapped: 80 or more critical, 60 high, 35 medium, 15 low, below 15 info. Some checks are capped by their type: hygiene checks at low, posture checks at medium, inventory checks at info.
Worked example
A section worth 15 with k = 8, on an estate of 40 hosts, with one high finding on an owned asset and two medium findings on attributed assets:
- Loads: 5 × 1 = 5; 2 × 0.8 = 1.6 each, so 3.2.
L = 8.2. - Size: hosts ÷ 10 = 4, so
L_norm = 8.2 ÷ 4 = 2.05. - Deduction:
100 × 2.05 ÷ (2.05 + 8) = 20.4. - Section score:
79.6. - When every section is measured (total weight 100), this section contributes 15 × 79.6 ÷ 100 = 11.9 of its 15 points, so it costs 3.1 points.
Fixing the high finding drops L to 3.2, L_norm to 0.8, the deduction to 9.1 and the section score to 90.9.
Points per finding
The Issues tab and Action plan show "−N points" per finding. Points are shared out in hundredths across the counted findings of a section in proportion to their load, so they add up exactly to the section's deduction. The Action plan is the ten counted findings that cost the most.
Personalisation (security score only)
The effective weight of a section is standard weight × section multiplier × module multiplier. Section multipliers can be 0.5 to 2, module multipliers 0 to 2, set under Settings. Values outside the methodology's bounds are refused, not silently clamped.
Use cases and wiring tips
- Explain a score to an auditor. Screenshot the Rating tab and the "How is this calculated?" panel; every number above appears there.
- Predict the effect of a fix. Action plan shows the points restored to a section when a finding is no longer seen; use it to sequence work before a review.
- Do not compare the security score across organisations. Weights and criticality make it personal. Use the standard rating for comparison.