Risk & Scoring
How Security is scored
A weighted control pass rate over distinct controls, reduced by posture penalties, requiring both passing and failing evidence to compute at all.
The calculation
- Collapse every control record to a distinct control.
- Weight each control by its severity: critical 10, high 6, medium 3.
- Compute the weighted pass rate across all evaluated controls.
- Subtract Security Hub posture penalties.
- Apply the critical ceiling to the resulting band.
Both halves are required
Passing and failing results. Without a denominator there is no rate, and the domain is reported as not assessed rather than scored from failures alone.
This is why the scan is run in a mode that returns passes as well as failures, and why a scan returning only failures is treated as a collection problem rather than a catastrophic result.
Posture penalties
| Observation | Penalty |
|---|---|
| Security Hub disabled | 12 |
| Cross-region finding aggregation disabled | 6 |
| No delegated administrator | 4 |
These describe the account's own detection posture. They are subtracted from the domain score rather than folded into the control population, so the pass rate stays a pass rate.
Minimum population
Below 25 evaluated controls the domain is not rated at all. A single passing control is not evidence of security governance. The observations are still reported.
What is excluded from the denominator
Records that could not be classified, and low or informational severities, which are never collected. See What is excluded, and why.