Introduction
The security score indicates an organization’s exposure level based on active controls and unresolved alerts. It serves as an objective, visual real-time risk metric, helping security teams and stakeholders make informed decisions.
NIST Basis
This metric aligns with the NIST Cybersecurity Framework, mapping controls and findings to the functions Identify, Protect, Detect, Respond, and Recover. Alignment with NIST ensures adherence to a recognized standard and eases audit and compliance processes.
Score Calculation
Assessment of active controls: Review the status and effectiveness of each enabled security control.
Classification of pending alerts: Group unresolved alerts by severity level (critical, high, medium, low) and count their occurrences.
Aggregation with severity weighting: The algorithm penalizes more severe alerts more heavily, combining volume and criticality to yield a value between 0 and 100.
Risk Ranges
0–32: Critical Risk
High exposure. Requires immediate attention and urgent action.
33–65: High Risk
Significant exposure. Prioritize remediation of serious alerts.
66–99: Medium Risk
Moderate exposure. Maintain active monitoring and resolve outstanding issues.
100: Low Risk
Strong posture. Continue maintenance and monitoring.
These ranges help quickly identify urgency level and guide resource allocation.
Importance and Benefits
Clear visibility: Enables teams and leadership to instantly see security status.
Effort prioritization: Focuses resources on critical alerts that most affect the score.
Effective communication: Facilitates internal and external reporting with quantitative metrics.
Compliance and audit support: Demonstrates alignment with NIST and best practices, aiding regulatory reviews.
Benchmarking and evolution: Allows comparison of the score over time to measure the impact of improvement initiatives.
Incident Prevention
By identifying and resolving alerts before they escalate, you reduce:
Security breaches
Data loss
Operational disruptions
Regulatory risks and penalties
How to Improve the Score
Resolve alerts by severity: Prioritize critical alerts first, then address lower-severity issues.
Enable and strengthen controls: Ensure all available controls are active and properly configured.
Periodic reviews: Conduct internal audits of devices, configurations, and policies.
Response automation: Implement playbooks for early detection and remediation of new alerts.
Ongoing training: Educate teams on risk identification and best practices to reduce recurring alerts.
Real-time monitoring: Ensure any relevant change updates the score immediately, reflecting the actual posture.
Automatic Update
The platform recalculates the score in real time as device states, alerts, and controls change. Whenever an alert is created or resolved, or a control is modified, the score updates instantly to reflect current exposure.