A security score summarizes multiple findings into one number. It helps prioritize work, but the number should always be read together with the evidence and severity of individual findings.
Critical findings
Critical findings represent conditions with potentially severe consequences or immediate loss of a core protection. Examples may include unavailable HTTPS, expired certificates or confirmed public secret exposure.
High-severity findings
High findings can materially increase risk and should be prioritized. Examples may include a missing enforced CSP, insecure authentication cookies or invalid email-security records.
Medium findings
Medium findings usually represent meaningful weaknesses that require correction but may depend on application context or other conditions.
Low findings
Low findings are normally configuration improvements or defense-in-depth measures. Multiple low findings can still indicate weak security maturity.
Informational findings
Informational results document observed conditions such as DNS records, technologies or the absence of cookies. They should not automatically reduce the score.
Inconclusive results
If a check cannot be completed because of timeout, parsing failure or unavailable data, it should be marked inconclusive rather than automatically failed.
Why category limits matter
Without category caps, several related missing headers could reduce the score more than a single critical transport failure. A balanced scoring model limits total deductions within related categories.
How to prioritize remediation
- Confirm critical findings immediately.
- Fix high findings with clear evidence.
- Address medium issues in the next security cycle.
- Schedule low and defense-in-depth improvements.
- Rescan after changes.