How the Retrievy Index is calculated
Your Retrievy Index is one number between 0 and 100. This page shows you how Retrievy gets to that number, what changes it, and what stays out of it.
The page explains the math. To see the score in action, open the Command Center.
The three inputs
Three numbers go into the formula:
- Weighted failure count. The sum of your open findings, each multiplied by its severity weight (a Critical counts for 100, a High for 20, a Medium for 5, a Low for 1). The bigger this number, the harder your score gets hit.
- Audit size. Every check a scan ran. On the Dashboard this is the Total Audits tile (also labelled Checked on per-module dashboards). A bigger audit dilutes each failure.
- Per-module weight. A small internal factor between 3 and 5 that adjusts how forgiving the score is for each module. You don't set it. Retrievy assigns it based on the typical size of each module's audit. See the table further down.
Multiply your audit size by the per-module weight to get your scaled audit size. That's what the formula compares your weighted failure count against.
The formula
scaled audit size = audit size × per-module weight
Retrievy Index = 100 ÷ (1 + weighted failure count ÷ scaled audit size)
Three things worth noticing on the curve:
- Zero open failures always produces a score of 100. Perfect posture.
- The score approaches 0 but never reaches it. A catastrophic environment still gets a positive number, just a very small one.
- A 1000-check cloud scan with five High findings ends up with a much higher score than a 10-check scan with the same five, because the failures dilute across a larger audit size.
Severity weights
The severity badge on each finding (CRIT, HIGH, MEDI, LOW, or Informational (Hygiene)) sets its weight in the math.
| Severity badge | Weight |
|---|---|
| Critical (CRIT) | 100 |
| High (HIGH) | 20 |
| Medium (MEDI) | 5 |
| Low (LOW) | 1 |
| Informational (Hygiene) | 0 |
A Critical finding hurts 100 times more than a Low one. Informational findings carry zero weight, stay out of the formula entirely, and don't count toward your audit size either. They can't quietly inflate the divisor and soften your score.
Per-module weight
The per-module weight controls how forgiving the score is for each module. Higher means less sensitive (each finding dilutes across more checks). Lower means more sensitive (each finding counts for more). You don't configure these. Retrievy sets them based on each module's typical audit size.
| Module | Weight | Why this value |
|---|---|---|
| CSPM (cloud) | 5.0 | Default. Cloud scans typically include hundreds of checks. |
| ISPM (identity) | 5.0 | Default. |
| SCM FortiGate CIS | 5.0 | Default. |
| SCM FortiGate Policies | 4.0 | Operational posture issues carry more weight than CIS compliance. |
| SCM Windows AD CIS | 5.0 | Default. |
| SCM Windows AD Policies (GPO X-Ray) | 3.0 | Small audit surface. Each finding represents a meaningful gap. |
What counts and what doesn't
Counts toward your weighted failure count: any finding currently showing the Open or Reopened badge, at Critical, High, Medium, or Low severity. These are the findings sitting in the Kanban Triage Required column.
Does not count toward your weighted failure count: findings with the Risk Accepted badge (in the Kanban Accepted Exceptions column) or the Pending Verification badge (in the Verifying Remediation column). They still appear on dashboards and in the Kanban so you can see them. They stay out of your score so it reflects active risk only. Accepting a risk should remove it from your score, not from your awareness.
Counts toward your audit size: every check a scan ran. That includes the passes (counted under Passed on the dashboard), findings you accepted as risk, and findings pending verification. This is intentional. If exceptions shrank the audit size, accepting a risk would silently raise the cost of every other finding.
Does not count toward your audit size: Informational findings.
Grade bands
Retrievy converts the raw score into a letter grade for quick eyeballing. You'll see it next to the score on every dashboard and in PDF reports.
| Grade | Score range |
|---|---|
| A | 90 to 100 |
| B | 75 to 89.9 |
| C | 60 to 74.9 |
| D | 40 to 59.9 |
| F | below 40 |
Aggregation across modules
The Retrievy Index on your main Dashboard is not the average of your per-module scores. Averaging would give a 10-check FortiGate scan the same weight as a 1000-check cloud scan, hiding the difference in audit size.
Instead, the global score sums all severity counts across every module, sums each module's scaled audit size independently so each module's weight still applies, then runs the formula once on the totals.
Worked example
A workspace with two scans:
- CSPM scan: 200 checks, 1 High finding, 3 Medium findings.
- SCM FortiGate Policies scan: 50 checks, 0 High findings, 2 Medium findings.
Step 1, sum the severity counts:
- High: 1
- Medium: 5
- Critical and Low: 0
Step 2, the weighted failure count:
weighted failure count = (0 × 100) + (1 × 20) + (5 × 5) + (0 × 1)
= 0 + 20 + 25 + 0
= 45
Step 3, the scaled audit size (sum each module's separately):
scaled audit size = (200 × 5.0) + (50 × 4.0)
= 1000 + 200
= 1200
Step 4, the score:
Retrievy Index = 100 ÷ (1 + 45 ÷ 1200)
= 100 ÷ 1.0375
≈ 96.4
That score lands in band A.
When the score changes
The Retrievy Index recalculates whenever a finding's state changes:
- A new scan brings in new findings.
- You click Resolve Finding or Accept Risk on a finding card, or you drag a finding between Kanban columns.
- A Risk Accepted finding's exception period expires and the finding returns to Open.
- A new check is added to a module, changing your audit size.
Retrievy keeps per-module score history so you can see how each module trended over time, not just the global number.
Where you'll see this score
| Surface | Label you'll see |
|---|---|
| Main Dashboard | Retrievy Index (below the big number) |
| Info modal next to the score | Retrievy Score (modal title) |
| Tooltips | Global Index |
| CSPM and ISPM dashboards | Score (per-module number, for example 87.3%) |
| Executive and Technical PDF reports | Retrievy Index, with the grade letter and trend |
All five surfaces show the same number. The label changes with the context.