How to read a 0-100 security posture score honestly

Why a single number is appealing

A score compresses a complicated picture into something a non-specialist can hold in their head. That is genuinely useful: it lets an owner ask "are we better or worse than last quarter" without learning what a DMARC alignment mode is.

It is also dangerous in the same breath, because compression loses the thing that matters most — which specific controls produced the result.

What a defensible score is made of

A posture score should be reproducible arithmetic over defined inputs. In SMB Scanner Lite, each control reaches one of four statuses, each control carries a severity weight, and the score is a weighted mean over the controls that completed. Inconclusive controls are excluded from both the numerator and the denominator.

That last rule is the one most worth checking in any scoring model. If a scanner treats a timeout as a failure, a quiet network produces a bad score. If it treats silence as a pass, a filtering firewall produces a good one. Either way the number stops describing configuration and starts describing reachability.

What a grade band adds

Letter grades are a second compression on top of the first. They are useful for conversation and useless for diagnosis: nobody fixes a B, they fix a missing header.

The bands should be published and fixed, not adjusted per customer. Ours are A 90–100, B 80–89, C 65–79, D 50–64 and F below 50, and they are applied identically to every target.

Questions to ask before quoting a score

What was measured, and what was excluded? How were inconclusive results handled? What weights were used, and who decided them? Is the score comparable between two different scopes? How old is it?

If a vendor cannot answer those five questions, the number is decoration. If they can, the number is a useful index — still not a certificate, but an index with a methodology behind it.

The three ways scores get abused

Comparability. A sandbox score derived from eight controls is not comparable to a full 22-control assessment. Presenting them side by side without that context is misleading, which is why the sandbox report says so explicitly.

Guarantees. "Score 95, therefore secure" is a non-sequitur. The score describes measured configuration only.

Marketing. A high score on a marketing site is a claim about that site's configuration, not about the product or the business behind it.

Using one well

Treat the score as an index into the findings. Read the findings, act on the highest-severity ones, and re-assess after the change. The movement between two assessments of the same scope is more informative than either absolute value.

The methodology page documents the weights and the arithmetic. The recorded report shows a score next to the findings that produced it, which is the only responsible way to present one.