A rating you can argue with is a rating worth having.
A score nobody can interrogate is just a number with a colour. This is the whole model: how findings become module scores, how modules become a company rating, and exactly what moves it.
Three rules the model follows
Everything below follows from these. Where a design decision was a trade-off, it went in favour of being defensible.
Same inputs, same score
The rubric is weighted and versioned. Two companies with identical observable posture receive identical scores, and a rescan that finds nothing new does not move the number.
Every point traceable
A score is an aggregate of findings, and every finding carries the observation that produced it. You can always walk from the grade back to the raw evidence.
Only what is observable
Scores are built from what can be seen from the public internet. Nothing is inferred from a questionnaire, and nothing depends on the company under assessment cooperating.
From finding to grade
Six module scores, one weighted rating, one letter band.
| 0–100 per module | Each of the six modules is scored independently, so a strong perimeter cannot hide a weak brand posture. |
| Weighted aggregate | Module scores combine into one company rating using published weights rather than an average. |
| Letter grade | The rating maps to a letter band for reporting, so a board sees a grade and an engineer sees the number. |
| Severity-driven | A single critical finding moves a score further than a long tail of low-severity ones, count alone does not drive the result. |
What actually moves a score
Scores should move when posture changes and stay still when it does not.
| Score drops | A new critical or high finding, a newly published CVE affecting a detected technology, a newly registered lookalike domain, or fresh credential exposure. |
| Score rises | A finding is remediated and the next scan confirms it cleared, most domain findings clear automatically once the record changes. |
| Score holds | A rescan that finds nothing new. Scores do not drift with time or decay for inactivity. |
| Score is corrected | A finding is triaged as a false positive or accepted risk, with the rationale recorded in the audit trail. |
What the score is built from
- Findings observed from the public internet, across six modules
- Severity, with exploitability weighted via CVSS, EPSS and KEV
- Evidence recorded for every finding
- Analyst verification on brand-protection indicators
- Triage decisions you have recorded
What it is deliberately not built from
- Self-reported questionnaire answers
- Raw vulnerability counts
- Company size, sector or revenue
- Anything requiring access to your environment
- Time decay, a score does not drift on its own
The rating, with the six module scores underneath that produced it
Common questions
Run the model against your own company
The quickest way to test a scoring model is on a company whose posture you already know.
Free for your own organisation. Assessed by domain, no access required.