Risk Scoring

Scoring: Use Cases and Wiring Tips

This page collects the common jobs people do with scoring and how scoring connects to the rest of Hunto. Each recipe says exactly what to click, and what is not automatic today.

Recipes

Report a trend to the board

  1. Open Security posture, then History.
  2. Choose Standard rating for a like-for-like number, or Security score for the number you manage.
  3. Read the last quarter off the chart. Quote only filled points. Hollow points are provisional.
  4. Note any dashed line: a methodology change, not a change in posture.
  5. Attach a report from a finished run for the detail. See Scores in reports.

Fix the most, fastest

  1. Select Fix top issue or open Action plan.
  2. Work the list in order. It is sorted by points, not by severity, so it is the shortest route to a better grade.
  3. After each fix, wait for the next run (or use Rate now on the domain), then check History for the row under Fixed issues.

Recompute now does not prove a fix. Only a new run that no longer sees the issue does. See Issues and Action plan.

Gate vendor onboarding on a grade

  1. Look up the vendor's domain: on its domain page with Rate now, or with POST /api/v1/ratings. A shared rating answers free and at once, otherwise a new run costs 10 credits.
  2. Read the grade and whether it is provisional.
  3. Set a rule, such as: A or B continues, C needs a questionnaire, D or F and any provisional grade need review.
  4. Record the grade and date with the vendor record.

The API returns the newer of your own and the shared rating. It reflects outside-in evidence only. See Sharing, vendor view and domain verification and Scoring through the API and MCP.

Get told when a grade drops

There is no notification for a fall in the new grades today. Choose one of these:

  • Poll the API once a day: read GET /api/v1/posture/standard (and /posture) and compare with the previous value. Send a message to your chat tool when the grade is lower.
  • Read History at the start of each week. New issues and Fixed issues show what moved.
  • Repeat: set Weekly or Daily on your key domains so the grade never goes stale.

Turn top issues into tasks

Scoring does not create tasks. To do it by hand:

  1. Open Action plan and copy the top issues: title, asset and points.
  2. Create a task for each in Tasks, assigned to the owner of the asset.
  3. The task is done when the issue shows under Fixed issues on History.

Compare the standard rating with the outsider view

Your Standard rating is calculated on the same evidence and methodology as the outside-in rating others can look up. It ignores your own settings and accepted risks. To see the gap to your Security score, open Rating: the personalisation lines add up exactly to the difference. See Accepted risk, false positives, coverage and recompute.

Prove a domain is yours and keep it private

Verify the domain with the TXT record under Settings, then turn sharing off. See Sharing, vendor view and domain verification.

Find out why a grade changed

Open History, find the rating, open the row. Read New issues and Fixed issues. See History and rating changes.

How scoring connects to the rest of Hunto

Area Connection
Discovery Each finished discovery run of a root domain is rated. The grade you see is built from the latest eligible run per domain. Choose the checks, run again, or set Repeat to keep ratings fresh.
Detections and incidents Findings you add to detections from the run's Findings tab get a status. Accepted risk, false positive, whitelisted and resolved change the security score, and never the standard rating.
Assets Asset criticality (set in All Assets) weights findings in the security score. Each domain asset shows its Security rating card.
Tasks Manual. Create tasks from Action plan items.
Notifications No built-in alert for grade changes on the new ratings. Use the API to alert yourself.
Reports Report (PDF) on a finished run makes the Digital risk & exposure assessment.
Brand Protection, Human Risk, Compliance Their sections join your security score when the module is in your plan.
CLI No scoring commands today.
MCP Scorecard tools under the score permission. See Scoring through the API and MCP.
API /api/v1/ratings, /api/v1/runs/{runId}/rating and /api/v1/posture.
Credits A new Outside-in rating costs 10 credits. Reuse within 24 hours is free.

Common pitfalls

  • Reporting a provisional grade as final.
  • Comparing your security score with another company's standard rating. Compare standard with standard.
  • Expecting Recompute now to start a run. It only refreshes from existing runs.
  • Reading "Nothing found" as "nothing exists". See Nothing found is not the same as we could not look.