How scores are calculated

Every score returns the factors that produced it. Nothing here is a black box — if a number looks wrong, you can see which findings drove it.

Posture score

0 to 100, higher is better. Starts at 100; each severity band of open findings subtracts points.

Each band's contribution is capped, so a hundred low-severity findings cannot outweigh a single critical one.

Grades: A ≥ 90 · B ≥ 75 · C ≥ 55 · D ≥ 35 · F below 35.

If there isn't enough data yet, the dashboard says "Scans needed to calculate" rather than showing a misleading zero.

Finding priority

0 to 100, higher is more urgent. This is what to sort by when deciding what to work on.

Severity says how bad this class of issue is. Priority says how urgent this instance is, on this asset, right now.

Points are added for:

Then reduced for:

• Accepted risk — multiplied by 0.4, or 0.7 if the acceptance is expiring soon. Accepted findings stay visible but rank low, and the reduction appears as an explicit negative factor.
• Outcome calibration — if a particular kind of finding has historically turned out to be a false positive in your workspace, its priority is damped. This needs at least 5 resolved samples before it does anything, and the adjustment is conservative: down to 0.75 for a high false-positive rate, up to 1.1 for a kind you consistently resolve with few false positives.

Age matters, but logarithmically — a finding that's been open a year isn't fifty times more urgent than one open a week, and treating it that way would bury genuinely new critical issues.

Confidence score

0 to 100, describing how strongly the evidence supports a conclusion. High ≥ 70, medium ≥ 40, low below 40.

Freshness decays on a schedule: full marks within 24 hours, tapering to 15 points at a week, 3 points at 30 days, and nothing beyond that. Evidence has a shelf life.

The square-root curve on source count means a second corroborating source helps a lot and a sixth barely moves the number.

Don't confuse this with the confidence rating on a discovered asset. That one describes how sure Perimeter is that a candidate really belongs to you, and decides whether it is promoted automatically or held for your review. Different scale, different question. See Reviewing discovered assets.

SLA targets

Default remediation targets, measured from when a finding is first seen:

Informational findings use the low target. Administrators can configure custom per-organization targets.

The free scan is not scored

The unauthenticated scan on our website reports per-family verdicts, not a score. That is deliberate: a quick look at what is publicly visible is not an assessment of your security posture, and giving it a grade would invite you to read it as one.

Why scores change

A posture score can move without anyone doing anything wrong.

You found more. Discovering new assets finds new findings. A drop after a first full scan usually means better visibility, not worse security. Use scan comparison to see exactly what changed.

Coverage changed. Confidence is calculated against what a scan actually managed to assess. A scan that could reach less of your estate than the previous one will say so on its coverage record — check that before reading a confidence drop as a real change.

We changed how something is rated. Each score is stamped with the scoring model version that produced it, so a historical score always remains explainable against the rules in force when it was calculated. When we change a severity rating or a weight, the version changes with it.

Most recently, an absent SPF or DMARC record moved from medium to high severity. Nothing in the scoring formula changed, but the same domain now produces different factors and therefore a different score. Scores either side of a model version change are not directly comparable — compare within a version, and use the factor breakdown rather than the headline number when you cross one.