How the score is calculated

The score is deterministic

The security score is computed by a fixed ruleset. It is never produced by an AI. The same

configuration always produces the same score, which is what makes it meaningful to tell a client

their score went up.

An AI writes the plain-English narrative in reports, but it only writes *about* findings that the

ruleset already produced.

Category weights

Each category is scored out of 100 and combined by weight:

• Email authentication — 30%. Weighted highest because it is the most commonly exploited and the most commonly misconfigured, and because failures here are visible to every customer the business emails.
• Certificates and encryption — 25%.
• Website hardening — 20%.
• DNS and domain — 15%.
• Exposed surface — 10%.

Penalties

Every category starts at 100. Each failing check deducts points by severity:

• Critical: 55
• High: 30
• Medium: 15
• Low: 6

A warning — the configuration works but is not what it should be — deducts 45% of the value

above. A category cannot go below zero.

Skipped categories are not penalties

If a category produced no findings, it is dropped and the remaining weights are renormalised. A

passive scan does not run exposed-configuration checks, so a passive scan is never marked down

for the checks it deliberately did not run.

A category made up entirely of errors — a site that would not load at all, for example — is also

dropped, because guessing at a score from no data would be worse than saying nothing.

Grades

• A — 90 and above
• B — 80 to 89
• C — 70 to 79
• D — 60 to 69
• F — below 60

What a good score does not mean

A grade A means the externally visible configuration is in good order. It says nothing about

patch levels inside the network, password hygiene, backups, staff training, or whether somebody

is already inside. Anyone presenting an Marchpost report to a client should say so.