Per-module contributions to the Retrievy Index
Your Retrievy Index is the global view across every connected module. Each module also has its own per-module score that contributes to the global number, with a per-module weight that tunes how sensitive the module is to individual findings.
This page explains how those contributions add up, why the weights differ between modules, and what to expect when a single module's score moves.
This page is a concept. For the actual numbers, open the Command Center (global) or any module dashboard.
Modules that contribute
| Module | Where it shows up | What it measures |
|---|---|---|
| CSPM | CSPM dashboard | Cloud account posture: AWS, Azure, GCP, OCI, Cloudflare misconfigurations. |
| ISPM | ISPM dashboard | Identity risk: cloud IAM, Entra ID, Active Directory, FortiGate admin planes. |
| SCM Active Directory (CIS + GPO X-Ray) | SCM Active Directory dashboard | On-prem AD posture from the Retrievy Agent. CIS Windows hardening checks plus GPO X-Ray analysis. |
| SCM FortiGate (CIS + Policy Hygiene) | SCM FortiGate dashboard | FortiGate firewall posture. CIS admin-plane checks plus Layer-7 efficacy and Policy X-Ray. |
Each module also has its own Score card on the Command Center, alongside the global Retrievy Index.
Per-module weights
Retrievy assigns each module a small weight (between 3 and 5) that controls how sensitive the score is for that module. A higher weight makes the score more forgiving (each finding dilutes across a larger denominator). A lower weight makes it more sensitive (each finding counts for more).
You don't configure these. The values reflect each module's typical audit size.
| Module | Weight | Why this value |
|---|---|---|
| CSPM (cloud) | 5.0 | Default. Cloud scans typically include hundreds of checks. A single finding shouldn't tank the score. |
| ISPM (identity) | 5.0 | Default. |
| SCM FortiGate CIS | 5.0 | Default. CIS-style benchmark compliance. |
| SCM FortiGate Policies | 4.0 | Operational posture issues carry more individual weight than CIS compliance. |
| SCM Windows AD CIS | 5.0 | Default. |
| SCM Windows AD Policies (GPO X-Ray) | 3.0 | Smaller audit surface, each finding represents a meaningful gap. |
The two outliers are the policy-focused modules. FortiGate Policies at 4.0 reflects that operational misconfigurations (an unused permit-all rule, an SSL inspection exception) often have a bigger impact than a single CIS benchmark failure. Windows AD Policies (GPO X-Ray) at 3.0 reflects that the audit surface is smaller, so each gap is a larger fraction of your overall posture.
How a module's findings reach the global score
Every finding follows the same path:
- A scan ingests the finding with its severity (Critical, High, Medium, Low, or Informational).
- The severity sets the weight in the formula: Critical 100, High 20, Medium 5, Low 1, Informational 0.
- The finding adds to the weighted failure count of its module.
- Each module's audit size (total checks the scan ran) gets multiplied by the per-module weight to produce a scaled audit size.
- The global Retrievy Index sums every module's weighted failure count and every module's scaled audit size, then runs the formula once on the totals.
The formula itself is in How the Retrievy Index is calculated.
The important consequence: modules are not averaged. A module with a tiny audit surface (10 checks) and a module with a huge audit surface (1000 checks) both contribute to the global pool. The big module's findings dominate the global score because there are more of them, but the small module's per-module score still tells you how that specific area is doing.
Why a per-module score and the global score can move differently
Here's a common pattern: you fix five Critical findings on your CSPM module, and the CSPM per-module Score card jumps from 62 to 78. But your global Retrievy Index only moves from 71 to 73.
That's expected. CSPM is one of several modules feeding the global number. If CSPM was contributing 30% of your weighted failure count, fixing those Criticals removes that 30% from the global pool but the remaining 70% (ISPM, SCM, etc.) still drags. The global score moves less than the per-module score.
The reverse is also true: a single new Critical finding on a small module (like SCM Windows AD Policies, weight 3.0) can move that module's per-module score noticeably but barely change the global Retrievy Index.
When to look at which
Use the global Retrievy Index when:
- You want a one-number health check for the whole workspace.
- You're writing an executive report or talking to leadership.
- You're tracking month-over-month trend.
Use a per-module score when:
- You're working inside one domain (CSPM, ISPM, etc.).
- You want to know whether one specific module is improving while another stalls.
- You're explaining to a domain owner why their area's posture is what it is.
The four module slates on the Command Center (Post-Scan CSPM, Post-Scan ISPM, Post-Scan SCM, Policy Hygiene) give you both views at once: the per-module finding count plus the per-module status pill.