What is a Security Score? PentaTrail's 400-Point Model for Quantifying Your Attack Surface

What is a Security Score?

A security score expresses an organization's cybersecurity posture as a single number. By blending multiple indicators into one figure, it lets executives and security teams instantly grasp what's working and what isn't.

The industry convention is a 0–100 single score, but PentaTrail extends this into a 3-axis composite on a 400-point scale. Single-score models leave a clear gap: when the score drops, you can't immediately see why. The 3-axis breakdown solves that.

PentaTrail's 400-Point Model

The Executive Dashboard shows a total score (out of 400) alongside three sub-scores.

A high axis lifts the total score; a low one drags it down.

Threat Score (200 points)

Starting from open findings, the score is Base − three penalties. The penalties weigh more heavily for higher-severity findings.

For each active host, take the worst (highest) TER band across its open findings and aggregate at the host level.

Base

The base subtracts from 200 based on counts of A-band and B-band hosts. S-band hosts are handled by a separate penalty (see below). C- and D-band hosts do not affect the base.

Base = 200 × (1 − (A_hosts × 0.5 + B_hosts × 0.1) / total_active_hosts)

S host penalty (breadth)

Penalty by distinct host count with at least one S-band finding. If a single finding affects multiple hosts, every host counts. The wider S-band exposure spreads, the heavier the penalty.

S finding count penalty (density)

Penalty by distinct finding count classified as S band. This is an independent axis that captures how many S-band findings stack up on a single host.

The two axes differ: one critical CVE spread across 10 hosts (host penalty −150, count penalty 0) and 10 distinct critical CVEs stacked on a single host (host penalty −60, count penalty −10) describe different attack-surface shapes, so they are penalized separately. When both deteriorate, the penalties stack.

KEV penalty

min(40, KEV_count × 5): −5 per open KEV-listed finding, capped at −40.

Final

Threat Score = max(0, min(200, ROUND(Base) − S_host_pen − S_find_pen − KEV_pen))

For the band logic, see the TER explainer; for the underlying priority, see TDL (Threat Discovery Level).

Management Maturity Score (100 points)

Each of the three rates has a maximum point allocation. A rate at 100% earns its full allocation, 50% earns half, 0% earns zero. The three earned points are summed into the Management Maturity Score.

Examples:

• All three at 100% → 40 + 40 + 20 = 100 points
• All three at 50% → 20 + 20 + 10 = 50 points
• Grouping 100% / Classification 70% / Responsible 50% → 40 + 28 + 10 = 78 points

Grouping and Asset Classification are the main drivers (40 max points each); Responsible Assignment plays a supporting role (20 max). The more these progress, the sharper the TER band judgment becomes (especially on the BI axis), and the clearer the chain of responsibility for remediation.

Response Status Score (100 points)

This axis evaluates the health of the response process for detected findings, excluding "informational" priority findings.

Formula

Response Status Score = max(0, Decision Rate − S Overdue % × 0.5 − ABCD Overdue % × 0.15)

All three rates are 0–100 numeric values used directly as "points" (floored at 0, capped at 100).

What each rate means

• Decision Rate: a binary read (decided, or not yet decided) on each task, excluding "informational" priority. It's a task-unit metric, not a percentage of findings
  • Decision Rate = decided tasks ÷ live tasks × 100
  • Decided tasks = tasks that are In Progress, Resolved, or No Action Needed
  • Live tasks = decided tasks + Open (untouched) tasks
  • Completed tasks are excluded from the population (a task drops out automatically once a scan confirms the fix)
  • When there are no live tasks at all, and there are also zero open (unresolved), non-informational findings, the rate defaults to 100 (full marks)
  • If there are no live tasks but such open findings remain, the rate is 0 instead (fail-closed; marking tasks no-action-needed or otherwise clearing them out doesn't earn full marks on its own)

A note on terminology: "Resolved" and "Completed" are two different states. Resolved means someone self-reported a fix; it's still awaiting confirmation on the next scan, so it hasn't left the population yet. Completed means a scan actually confirmed the fix, and the task automatically dropped out. Decision Rate counts Resolved as "decided"; Completed tasks are removed from the count entirely.

• S Overdue %: among open S-band findings, the percentage past the S deadline of 7 days from first discovery (weight 0.5, max −50 at 100%)
• ABCD Overdue %: among open A–D band findings, the percentage past their band deadline from first discovery (A=14 / B=21 / C=28 / D=35 days) (weight 0.15, max −15 at 100%)

(Deadlines are derived automatically from the discovery date and the per-severity deadline: S=7 / A=14 / B=21 / C=28 / D=35 days. Because the band reflects business impact, the same vulnerability gets a shorter deadline on more critical assets.)

How Resolved findings are treated: a finding whose remediation task has been marked "Resolved" is excluded from both the S Overdue % and ABCD Overdue % (from both the numerator and the denominator). However, if another task matching the same finding is still "In Progress" or "Open," the finding is not excluded and continues to count toward the overdue rates. This exclusion is provisional; it holds until the next scan confirms the fix.

Example

Decision Rate 80% / S Overdue 40% / ABCD Overdue 20% → 80 − (40 × 0.5) − (20 × 0.15) = 80 − 20 − 3 = 57 points

This surfaces the "we detect but the work has stalled" state.

The two sub-sections of the Response Status panel

• MOBILIZATION (No Action Needed): count of findings marked "no action needed" (accepted) under the contract, broken down by the reason selected across three buckets (a finding-unit count):

  • No impact in this environment
  • False positive
  • Other (any other free-text reason, or unset)

  The Decision Rate's "decided tasks" count reflects the same "no action needed" decision, but Decision Rate is a task-unit metric. The MOBILIZATION finding count doesn't roll directly into the Decision Rate numerator; it's tracked separately, at the task level, alongside In Progress and Resolved tasks. Informational-priority findings/tasks (auto-classified) are excluded from both MOBILIZATION and the Decision Rate.

• Overdue: number of hosts, groups, and responsibles affected by findings past their per-severity deadline (S=7 / A=14 / B=21 / C=28 / D=35 days)

Indicators That Feed the Threat Score

The detection that powers the Threat axis is built from a wide range of indicators automatically collected during the ASM (Attack Surface Management) Discovery phase.

• SSL/TLS configuration: certificate validity, TLS version, cipher suites, HSTS
• Open ports and services: unnecessarily exposed ports, legacy protocols (FTP / Telnet, etc.), externally accessible admin panels
• Vulnerabilities: known CVEs, patch lag, software versions in use
• DNS configuration: SPF / DKIM / DMARC, DNSSEC, zone-transfer restrictions
• Information exposure: leaky error messages, directory listings, version disclosure, unnecessary HTTP headers

Each of these detections becomes a finding, gets classified into a TER band, and rolls up into the Threat score.

How to Read the Score

The Executive Dashboard displays the total score in three color tiers.

When the total drops, check the breakdown to see which axis is responsible.

• Threat is low → many S/A-band findings → use the TER map to find where they cluster
• Management Maturity is low → asset information is incomplete → progress on grouping, asset classification, and owner assignment
• Response Status is low → remediation is stalled → revisit decision-making or reallocate response capacity

How to Improve the Score

The improvement levers map directly to each sub-score's formula.

Threat (200 points)

The more findings sit in the S/A bands, the lower the score. The core action is to reduce the count of high-priority findings. Concretely, you can resolve or accept them from the Mobilization screen, or run AI Deep Scan validation; findings classified as "unconfirmed" have their TDL lowered by one level, which moves them into a lower band.

Management Maturity (100 points)

The formula is Grouping Rate × 0.4 + Asset Classification Rate × 0.4 + Responsible Assignment Rate × 0.2. Lift each rate directly:

• Create asset groups and assign hosts → Grouping Rate
• Tag hosts with BI Score (Purpose / Data Classification / Availability) → Asset Classification Rate
• Assign a responsible person to each asset group → Responsible Assignment Rate (per group, not per host)

The two 0.4-weighted rates (Grouping and Asset Classification) deliver the biggest impact.

Response Status (100 points)

The formula is Decision Rate − (S Overdue % × 0.5 + ABCD Overdue % × 0.15), where the overdue rates act as a penalty.

• Lift Decision Rate: move Open tasks forward by starting work (In Progress), self-reporting a fix (Resolved), or marking them No Action Needed
• Lower the overdue rates: resolve within each band's deadline (S in 7 days, etc.). S-band findings (weight 0.5, 7-day deadline) come first. Starting work (In Progress) alone doesn't clear the overdue rate; only marking the task "Resolved" removes it (provided no other In Progress/Open task still matches the same finding).

Executive Reporting

The Executive Dashboard itself is the weekly report for executives. In practice, the same screen consolidates:

• Total score + week-over-week delta + trend line (header)
• The three sub-score breakdown (Threat / Management Maturity / Response Status, in red / yellow / green panels)
• AI-generated CISO insights for each panel, refreshed weekly (Total, Threat, Management Maturity, Response Status)
• Week selector to navigate snapshot history

There's no need to author a separate report. Share this dashboard, or quote the AI-generated header summary directly in your weekly comms.

PentaTrail's Security Score

PentaTrail/CTEM covers the full CTEM framework, with the Executive Dashboard refreshing the 3-axis composite (400 points total) on a weekly cadence (What is CTEM?). For prioritization at the individual finding level, the TER band complements the score.

Learn more at our features page. To measure your score in practice, Start Your 14-Day Free Trial.