The score is calculated the same way every time and is published openly. The numbers below are read from the same rules the platform runs.
How it is calculated
- Start at 100.
- Subtract for each open finding: critical 20, high 9, medium 4, low 1.5, informational 0.
- Each category has a cap so that one noisy area cannot drag the score to zero: vulnerability 60, exposure 45, TLS 30, headers 16, configuration 15, cookies / CORS / DNS 12 each, redirects 10, content 8, technology 6, other 15.
Findings that are risk-accepted, marked false positive or resolved do not count. TLS, header and DNS findings are already inside that sum; they are shown as a share of it and never deducted twice.
Grades
| Grade | Score |
|---|---|
| A | 90–100 |
| B | 80–89 |
| C | 65–79 |
| D | 45–64 |
| F | 0–44 |
Coverage, availability and the organization score
- Coverage never changes the number; it qualifies it as full, partial or none. Skipped and inconclusive checks are never counted as passed.
- Availability (uptime and monitoring events) is shown next to the score and is not part of it.
- The organization score is the mean of its asset scores weighted by criticality (low 1, medium 2, high 3, critical 4).
- A daily snapshot feeds the trend chart. A drop of 10 or more points can trigger a notification.