A Security Score You Can Argue With
A security score is only useful if you can take it apart. AWRA’s posture score is six weighted parts, each with its own figure and the counts behind it, recalculated from your own workspace and snapshotted every morning so the day a control was weakened shows up the next day rather than at the next audit.
The short version
A single number is worth having only when every point of it can be traced to something you can fix. Score MFA coverage, open incidents, policy controls, the failed sign-in trend, stale devices and risky access, weight them, show the counts behind each, and keep a daily snapshot so a weakened setting is named the next morning.
The board of a Nairobi SACCO asked its IT officer a fair question after a phishing scare: are we more secure than we were in June? He had a list of things he had switched on, a list he meant to, and no way to say whether the total had moved. A dashboard that turns green when everything is fine does not answer it, because it never says how fine, or what changed.
Security scores have a bad reputation, and mostly earn it. A vendor’s score is usually a black box that rewards buying more of the vendor, cannot be reproduced, and drops for reasons nobody can name. The test we set ourselves was simpler: every point lost must point at a screen where it can be won back, and the arithmetic must be something an auditor could redo on paper.
Six parts, weighted
| Part | Weight | How it is scored |
|---|---|---|
| MFA coverage | 25 | Share of active people with a second factor switched on |
| Open incidents | 20 | 100, less 40 per critical, 15 per high, 5 per medium and 1 per low incident still open |
| Policy controls | 20 | Share of eight recommended controls switched on, less 10 for each one weakened since the last snapshot |
| Failed sign-in trend | 15 | This week’s failed sign-ins against last week’s; flat or falling is full marks |
| Device hygiene | 10 | Share of devices with access that have been seen in the last 90 days |
| Risky access | 10 | Falls twice as fast as the share of people holding a segregation-of-duties conflict |
The eight policy controls are the ones we would ask about in a review: MFA required for everyone, passwords of at least twelve characters, idle sessions that time out, accounts that lock after failed sign-ins, new devices that need approval, step-up for high-risk actions, the audit retention lock, and rooted phones blocked. The total maps to a grade: 85 and above is Strong, 70 is Fair, 50 is Weak, and anything lower is Critical.
One workspace, one morning
Illustrative figures. The cheapest points here are policy controls: switching on three controls is worth more than chasing the last six people without MFA.
Why the failed sign-in part has a floor
One failure last week and three this week is a tripling and not a crisis. The comparison never uses fewer than five as last week’s figure, so a quiet workspace is not punished for a typo on Monday.
The morning snapshot
Early every morning the score and the full security policy are stored for each workspace, one row per day. That snapshot is what makes drift visible. When a control is weaker today than in the latest snapshot before today, the security control center lists it by name under “weakened since the last snapshot”, and the policy part loses ten points for each, so the score drops on the day after the change rather than at the next review. It is a sibling of the setting that waits for a second person: one stops a control being loosened quietly, the other makes sure it is noticed if it is. Most of what the score weighs is the same access hygiene as ending a leaver’s logins and enforcing MFA, measured every day instead of at the next audit.
A score that cannot tell you which setting moved is a mood, not a measurement.
The last thirty days of daily scores are kept and returned with the score, which is the honest answer to the SACCO board’s question: not “are we secure”, which no number can say, but “are we more secure than a month ago, and which part moved”. The score, the grade, the six parts and the weakened list are on the security control center on the web and in the mobile app.
What AWRA OpsHub does today
- A posture score from 0 to 100 from six weighted parts, each with its own score, a one-line reading and the counts behind it.
- A grade: Strong, Fair, Weak or Critical.
- Eight recommended policy controls checked, and ten points off for each one weakened since the last snapshot.
- A daily snapshot of every workspace’s score and security policy, and the last 30 days kept.
- The weakened-since list, naming each control that is weaker than in the last snapshot.
- The score on the web and in the mobile app, in the security control center.
More we can add to your workspace
- A 30-day trend chart on the security screen, drawn from the snapshots already kept.
- Weights you set yourself, so a workspace that cares most about devices can say so.
- An alert when the score drops a grade, to the people who manage security.
Where we point you to a specialist
- We will not call a workspace secure because its score is high. The score measures the controls the system can see, and your auditor judges the rest.
The trend chart is the quickest of the three, because the daily snapshots it needs are already being stored.
A score shaped to what you are measured on
The parts, the weights, the daily snapshot and the drift list are in place. These extensions come up most often.
The trend on screen
Thirty days of scores drawn as a line, with the day each control was weakened marked on it.
Your own weights
Weight devices or access more heavily where that is what your regulator or donor asks about.
A grade-drop alert
An email and a bell entry when the workspace falls from Strong to Fair, or Fair to Weak.
Three questions for any security score
If the score drops five points, can you show me which setting did it?
What you will probably hear
It is calculated from many signals.
How to read it
Then nobody can act on it. Each point should name its cause.
Could I work the score out myself from your formula?
What you will probably hear
The model is proprietary.
How to read it
An auditor will not rely on a number they cannot reproduce.
What was our score on the first of last month?
What you will probably hear
We only show today’s.
How to read it
Without history you cannot tell a board whether anything improved.
See security operations
Sessions, IP rules, device trust, MFA, step-up and the security control center where the posture score lives.
Explore security operationsFrequently asked questions
What goes into the security posture score?
Six parts: MFA coverage (25%), open incidents (20%), policy controls (20%), the failed sign-in trend (15%), device hygiene (10%) and risky access (10%). Each has its own score and the counts behind it.
What do the grades mean?
A score of 85 or more is Strong, 70 or more is Fair, 50 or more is Weak, and anything below 50 is Critical.
How often is the score recorded?
A snapshot of the score and the security policy is stored every morning, one per day, and the last 30 days are kept with the score.
What does weakened since the last snapshot mean?
A control that is weaker today than in the latest daily snapshot, such as MFA moved from required to optional. It is listed by name, and the policy part loses ten points for each.
Can we see the score in the mobile app?
Yes. The score, grade, six parts and the weakened list are in the app’s security screen as well as on the web.
