Score Models

Blends the entity's linked risk scenarios with its business criticality: 60% from the strength-weighted average of the linked risk scores, 40% from criticality (low 25, moderate 50, high 75, critical 100). An entity with no linked risks falls back to 40% of its criticality alone — that scores low on purpose, because an unassessed entity should not outrank one with measured risk.

Example: A CRITICAL entity (100) with one linked risk scored 20/25 — normalised to (20 / 25) x 100 = 80 — scores 80 x 0.6 + 100 x 0.4 = 88. The same entity with no linked risks scores 100 x 0.4 = 40.

Averages the latest test result across every linked control — fail 100, never tested 70, partial 60, pass 0 — weighting key controls double. A control with no test on record counts 50. An entity with no linked controls at all scores 60, because missing assurance is a gap rather than a clean result.

Example: Two linked controls — a key control that failed (100 x 2) and a non-key control that passed (0 x 1) — score (200 + 0) / 3 = 66.7, rounded to 67.

Adds up points across every linked issue. An open issue scores by severity (critical 40, high 25, moderate 12, low 5), plus 8 if it is past its due date and 6 if it is a repeat finding. An issue closed within the last year still carries a quarter of its severity points as residual signal; anything closed longer ago counts nothing. The total is capped at 100.

Example: One open CRITICAL issue that is overdue and a repeat finding scores 40 + 8 + 6 = 54. Add a HIGH issue closed three months ago (25 x 0.25 = 6.25) and the factor reaches 60.

Adds up points across every unresolved cyber signal linked to the entity: severity (critical 35, high 20, moderate 10, low 4), plus 15 if the vulnerability is being exploited in the wild and 8 if the affected surface is internet-exposed. Resolved signals score nothing at all. The total is capped at 100.

Example: One unresolved CRITICAL signal that is both exploited in the wild and internet-exposed scores 35 + 15 + 8 = 58.

Fixed points for what the entity is: 40 for handling sensitive data, 30 for AI usage, 10 for being internet-facing. Unresolved data-risk and AI-governance signals add 10 each, up to a maximum of 20. The total is capped at 100. Unlike most factors this reads the entity’s own attributes rather than its audit history, so a brand-new system can score high immediately.

Example: An internet-facing system that holds sensitive data and uses AI scores 40 + 30 + 10 = 80. One open data-governance signal takes it to 90.

Scales the months since the last audit against a 36-month cycle, so 18 months scores 50 and anything past 36 months scores 100. An entity that has never been audited scores 100 if it is high or critical criticality, and 85 otherwise. Measured against the plan’s as-of date, never the wall clock, so a score run is reproducible.

Example: An entity last audited 24 months before the plan date scores 24 / 36 x 100 = 66.7, rounded to 67.

Starts from lifecycle status — changing 70, onboarding 60, retiring 30, active 20 — then adds 15 for AI usage and 10 for being internet-facing. It exists to surface entities that are moving, which risk and issue history cannot see yet precisely because there is no history to read.

Example: A system mid-migration (changing, 70) that also uses AI scores 70 + 15 = 85, even with a clean issue and control record.