Scoring
Weighted pass rate
The security domain calculation: distinct controls that passed, weighted by severity, over all controls evaluated.
The calculation
Each distinct control is weighted by its severity: critical 10, high 6, medium 3. The score is the weighted proportion that passed.
Why weighted
An unweighted rate treats a failing critical control and a failing medium control as one failure each. Weighting makes the score reflect what the controls are worth.
Why a rate at all
A rate has a natural denominator and a natural ceiling, so it is comparable between accounts and between assessments. A penalty accumulated from failures has neither.
Both outcomes required
Without passing results there is no denominator, and the domain reports as not assessed rather than being scored from failures alone.
What limits it
The critical ceiling. A high pass rate can coexist with failing critical controls, and the ceiling stops that producing a green band.
What it does not mean
A pass rate over the scanner's catalogue is not a pass rate over everything that matters. See Coverage limits, domain by domain.