Skip to main content

Health Score Modeling

HostedScan calculates health scores for all your targets to help you easily spot criticalities and prioritize actions. Each target gets a numeric health score from 0 to 1000; lower is better, higher is worse. A letter grade is also assigned based on the score (A, B, C, D, and F) to cluster what we believe are significant thresholds.

What data is included​

The model only uses vulnerability findings that are:

  • Open
  • Not accepted as risk exceptions
  • Within your organization's configured OpenVAS Quality of Detection (QoD) threshold

How the score is computed​

For each target, HostedScan computes the score in four stages:

  1. Group open findings by severity (LOW, MEDIUM, HIGH, CRITICAL) and count each group.
  2. Determine the highest severity present on the target. This severity defines the primary score tier.
  3. Increase score inside that tier using a diminishing-returns curve as findings accumulate.
  4. Let lower-severity findings add weighted lift within the same tier (capped).

The highest severity present sets the baseline:

  • LOW starts at 10
  • MEDIUM starts at 150
  • HIGH starts at 350
  • CRITICAL starts at 700

Additional findings of the same highest severity push the score upward toward the top of that severity tier, but with diminishing impact per additional finding. Lower-severity findings cannot move the target into a higher severity tier by themselves, but they can raise the score within the current tier.

Letter grade mapping​

Grades are fixed numeric bands over the 0-1000 range:

  • A: 0-200
  • B: 201-400
  • C: 401-600
  • D: 601-800
  • F: 801-1000

How to interpret changes​

  • A new higher-severity finding usually causes the largest jump.
  • Many additional findings of the same severity cause smaller incremental increases over time.
  • Accepting or closing open findings lowers the score when those findings are excluded from computation.
  • If there are no open, unaccepted findings, the score returns 0 (A).