How the security posture is calculated
An open model for grade, coverage and freshness.
The security posture is a summary of the findings Värn has made. The model is deliberately simple and fully open, so you can always explain why the grade is what it is.
Score
The score starts at 100 and goes down for every active finding (status Open or In progress) based on its severity. Deductions are capped per level, so that many small issues do not hide the serious ones.
| Severity | Deduction per finding | Maximum deduction |
|---|---|---|
| Critical | −25 | −60 |
| High | −10 | −40 |
| Medium | −4 | −20 |
| Low | −1 | −8 |
Grade
| Grade | Score | Description |
|---|---|---|
| A | 90–100 | Strong |
| B | 75–89 | Good |
| C | 60–74 | Needs improvement |
| D | 40–59 | Weak |
| E | below 40 | Critical |
A critical finding gives at best grade D, and a high finding at best C – whatever the score. A single serious problem should never be able to hide behind an otherwise good result.
Coverage and freshness
- Only verified assets with active monitoring are included.
- An asset counts as covered if it has been assessed in the last 7 days.
- If fewer than 80% of the assets are covered, the security posture is marked as Preliminary.
- If there is no assessment at all, Not assessed is shown – no grade.
What does not count
Accepted risks, false positives and demo data do not affect the security posture.
A measure of what we check
The security posture reflects Värn's external checks. It is not a measure of all security in the organisation – internal systems, routines and staff behaviour are not included.