Methodology
How the security score works
A number from 0 to 100 that describes your security posture as far as TasScan checked it. These tables come straight from the scoring rules the platform runs.
Methodology version score-v2. score = clamp(100 - sum(open findings weight, capped per category), 0, 100); TLS/headers/DNS findings are inside that sum (no second deduction); coverage and availability are reported separately and do not change the number; organization = asset scores weighted by criticality (low 1, medium 2, high 3, critical 4).
Points deducted per open finding
| Severity | Points |
|---|---|
| Critical | 20 |
| High | 9 |
| Medium | 4 |
| Low | 1.5 |
| Informational | 0 |
Informational findings are shown but never reduce the score.
Grade bands
| Grade | Minimum score |
|---|---|
| A | 90 |
| B | 80 |
| C | 65 |
| D | 45 |
| F | 0 |
Deduction cap per category
| Category | Maximum points |
|---|---|
| Vulnerability | 60 |
| Exposure | 45 |
| Tls | 30 |
| Headers | 16 |
| Configuration | 15 |
| Cookies | 12 |
| Cors | 12 |
| Dns | 12 |
| Redirects | 10 |
| Content | 8 |
| Technology | 6 |
| Any other category | 15 |
Capping stops one noisy category from zeroing the score on its own.
Organization score: asset criticality weight
| Asset criticality | Weight |
|---|---|
| Low | 1 |
| Medium | 2 |
| High | 3 |
| Critical | 4 |
The organization score is the average of asset scores weighted by criticality.
- Counted: findings with status confirmed, in progress, new, reopened. Resolved, risk-accepted and false-positive findings do not count.
- Coverage: coverage never changes the number; it qualifies it. Skipped and inconclusive checks are never counted as passed.
- Availability: uptime is reported next to the score and is not part of it.
Your security score is a number from 0 to 100. Higher is better. It is recalculated after every scan, and a snapshot is taken daily for the trend chart. It describes your security posture as far as TasScan checked it, not a guarantee that nothing is wrong.
Start at 100, then subtract:
| Component | How it is computed | Maximum deduction |
|---|---|---|
| Open findings | Critical 20 · High 9 · Medium 4 · Low 1.5 · Informational 0 points each. Deductions are capped per category so one noisy category (e.g. many header findings) cannot zero the score on its own. | capped per category |
| TLS, security headers, DNS | Already included in the open findings above (and in their category caps). They are shown as a share of the penalty, never deducted a second time. | none extra |
The result is never below 0. Every deduction is listed in the breakdown with the finding, its severity, the points and the reason.
What was checked. The breakdown lists which scanner modules ran to completion, which were skipped or unsupported for this asset, and which were inconclusive (timed out, blocked, authentication failed, or errored). Skipped and inconclusive checks are never counted as passed. The coverage level is full (every module finished), partial (some did not) or none (nothing was evaluated or coverage was not recorded). A score with partial or no coverage is provisional: "no findings" then means "nothing found in what was checked".
Availability is separate. Uptime and monitoring events (downtime, change events) are shown as an availability indicator next to the score. They do not raise or lower the security score. (Methodology score-v1 added or removed up to 3 points for monitoring; score-v2 does not.)
Why did it change? The breakdown compares with the previous daily snapshot and lists findings that are new, resolved or reopened, changes in coverage, and any change to the weights or methodology.
Asset score vs organization score. Each asset has its own score. The organization score is the average of asset scores weighted by asset criticality (low ×1, medium ×2, high ×3, critical ×4), so a critical production site counts four times as much as a low-criticality staging site.
What changes the score. Resolving findings (confirmed by a rescan or Verify Fix), marking a finding as risk accepted or false positive (it no longer counts, but it stays visible with its reason; it counts again when the acceptance expires), new findings, and changing an asset's criticality (changes its weight, not its own score).
What does not change the score. Findings in informational severity, resolved findings, coverage gaps, availability, and platform activity such as generating reports.
Severity vs measured data. Severity is assigned by TasScan from the rule catalog (some rules, for example a cookie without the Secure flag, depend on what the cookie is for) and may be adjusted by at most one level for asset criticality and exposure. A technology or version that was merely observed is not treated as a confirmed vulnerability; where a finding is matched to an advisory, the advisory source, matching basis and uncertainty are shown on the finding.
Grades: A 90–100 · B 80–89 · C 65–79 · D 45–64 · F 0–44.
Methodology version: score-v2. Changes are announced in the changelog and never applied retroactively to historical snapshots; snapshots computed with score-v1 keep that label and their values.
Let's talk
Start with a free external check.
Run the free security check now. An account lets you verify your domain and unlock the full report.
TasScan is invite-only right now. Request an invite and we will be in touch.