Scoring rules catalog
A reference table for everything that feeds your Retrievy Index. For the formula itself and the worked example, see How the Retrievy Index is calculated. For why each module weighs what it does, see Per-module contributions.
Severity weights
The severity badge on each finding sets its weight in the weighted failure count.
| Severity badge | Weight | UI label variants |
|---|---|---|
| Critical | 100 | "Critical", "CRIT" |
| High | 20 | "High", "HIGH" |
| Medium | 5 | "Medium", "MEDI" |
| Low | 1 | "Low", "LOW" |
| Informational | 0 | "Informational (Hygiene)" |
A Critical hurts 100 times more than a Low. Informational findings carry zero weight and stay out of both the weighted failure count and the audit size.
Per-module sensitivity
The per-module weight controls how forgiving the score is for each module. Multiply your audit size by it to get the scaled audit size.
| Module | Per-module weight | Why this value |
|---|---|---|
| CSPM (cloud) | 5.0 | Default. Cloud scans typically include hundreds of checks. |
| ISPM (identity) | 5.0 | Default. |
| SCM FortiGate CIS | 5.0 | Default. CIS benchmark compliance. |
| SCM FortiGate Policies | 4.0 | Operational posture issues carry more weight than CIS compliance. |
| SCM Windows AD CIS | 5.0 | Default. |
| SCM Windows AD Policies (GPO X-Ray) | 3.0 | Small audit surface; each finding represents a meaningful gap. |
Higher weight means a more forgiving score (each finding dilutes across more checks). Lower weight means a more sensitive score (each finding counts for more). You don't configure these. Retrievy sets them based on each module's typical audit size.
Grade bands
The raw 0-100 score converts to a letter grade for quick reading.
| Grade | Score range |
|---|---|
| A | 90 to 100 |
| B | 75 to 89.9 |
| C | 60 to 74.9 |
| D | 40 to 59.9 |
| F | below 40 |
The letter shows next to the score on every dashboard and PDF report.
What counts toward the weighted failure count
| Finding state | Counts toward the weighted failure count? | Notes |
|---|---|---|
| Open | Yes | New findings from the most recent scan. |
| Reopened | Yes | Findings that came back after a Resolved state. Treated as Open for scoring; tagged separately so the team knows they regressed. |
| Pending Verification | No | You clicked Resolve Finding and Retrievy is waiting for the next scan to confirm. Stops counting immediately when you flip to this state. |
| Resolved (Verified) | No | Scanner confirmed the fix. Terminal state. |
| Resolved (Automated) | No | Scanner detected the issue is gone without explicit action (resource deleted, auto-remediated). Terminal state. |
| Risk Accepted | No | Formal acceptance via the Security Exceptions registry. Stops counting until the exception expires or is revoked. |
What counts toward your audit size
Every check the scan ran except Informational ones. That includes:
- Checks that passed (shown under the Passed KPI tile).
- Findings with the Open / Reopened badge.
- Findings with the Risk Accepted badge (intentional: an exception shouldn't shrink your denominator).
- Findings with the Pending Verification badge (same reasoning).
- Findings that already moved to one of the Resolved states.
What does NOT count toward audit size: Informational findings (severity weight 0).
Aggregation across modules
The global Retrievy Index on the Command Center is not the average of per-module scores. The math sums severities and scaled audit sizes across every module, then runs the formula once on the totals. See Per-module contributions for why and what that means in practice.
When the score recalculates
| Trigger | Effect |
|---|---|
| New scan completes | Findings ingest, score recomputes. |
| You click Resolve Finding on a card | Status flips to Pending Verification. Score rises by that finding's severity weight. |
| You click Accept Risk on a card and finish the Security Exception flow | Status flips to Risk Accepted. Score rises by that finding's severity weight. |
| You Revoke a Security Exception or it expires | Affected findings return to Open. Score drops by their severity weight. |
| A check is added to a module | Audit size grows. Scaled audit size grows. Score rises slightly. |
| Scanner re-checks a Pending Verification finding and confirms | Status flips to Resolved (Verified). No score change (the finding was already excluded). |
| Scanner re-checks a Pending Verification finding and still sees the issue | Status flips back to Reopened. Score drops by the severity weight (the finding re-enters the weighted failure count). |
Where you'll see the score in the app
| Surface | Label |
|---|---|
| Main Dashboard (Command Center) | Retrievy Index below the big number. |
| Info modal next to the score | Retrievy Score as the modal title. |
| Tooltips | Global Index. |
| CSPM, ISPM, SCM dashboards | Score as the per-module number (for example 87.3%). |
| Executive and Technical PDF reports | Retrievy Index with grade letter and trend. |
All five surfaces show the same number; the label changes with the context. See How the Retrievy Index is calculated for the math.