One check, one setting, one answer
Every Black Cat finding traces back to a single, deterministic OPA/Rego rule that looks at one concrete setting. “Does this Okta administrator have MFA enrolled?” “Does this GCP bucket allow public access?” “Is external sharing for this SharePoint site restricted to named guests?” The rule reads the configuration your connector fetched, compares it with the expected value, and returns pass or fail. The same configuration always produces the same result, and the finding shows you which rule fired, which setting it read, and what to change.
There is no model guessing at your risk, no confidence percentage, and nothing that changes between two scans of an unchanged tenant. Every rule in the Policy Catalog is documented with its severity, its remediation steps and, where a framework control applies, the control it satisfies.
Severity levels
Each rule carries one of five severities, set by us and adjustable per tenant with a severity override:
- Critical — directly enables account or tenant takeover, or exposes data to the public: an admin without MFA, a publicly readable storage bucket, an anonymous-access sharing link on a sensitive site.
- High — materially widens the blast radius of a compromise: standing global-admin roles, over-broad OAuth scopes, audit logging disabled.
- Medium — weakens a control without breaking it: short log retention, missing session timeouts, legacy protocols left enabled.
- Low — hygiene and hardening: naming, ownership, housekeeping defaults.
- Info — inventory facts that are useful to know but carry no penalty: an AI agent exists, an integration was added.
From findings to a Posture Score
The Posture Score you see on the dashboard, in the executive report and in every scan report is computed from three components, each on a 0–100 scale:
- Findings — start at 100 and subtract 10 points for every open critical finding, 5 points for every high, 2 points for every medium and 0.5 point for every low. Info findings cost nothing. The component never goes below 0.
- Compliance — the average of your enabled frameworks’ scores, where each framework score is the share of its mapped controls whose policies currently pass. If you enabled ISO 27001 and DORA, this is the mean of the two.
- Connector health — the share of your connectors that are active and scanning: active ÷ total × 100. A tenant with no connectors scores 100 here, because nothing is unhealthy.
The composite blends them with fixed weights: 40 % findings, 40 % compliance, 20 % connector health.
Two rules keep the number honest:
- No data is absent, not zero and not 100. If you enabled no compliance framework, the compliance component is absent: it is left out and the remaining weights are re-normalised across the components that exist. A tenant with findings and health but no framework is scored on 40 + 20, scaled back to 100, not penalised for a component it never turned on.
- No scan evidence, no score. The findings component is the anchor. Until a scan has produced evidence, there is no Posture Score at all, rather than a flattering placeholder.
The same functions produce the number everywhere it appears; there is no separate “dashboard formula” and “report formula”.
Grades
The composite maps to a letter grade in fixed bands: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, and F below 40. Each connector also gets its own grade from the same bands, computed on that connector’s findings alone, so the connector page tells you which app is dragging the tenant grade down.
The bands are the same for every tenant and every plan. A “B” means the same thing for a two-connector startup and a forty-connector enterprise.
What moves the score
Because the penalties are published, you can plan the work that moves the grade:
- Fix criticals first. One open critical costs as much as two highs or five mediums. Ten open criticals alone take the findings component to zero.
- Approved exceptions remove the penalty. When a finding is accepted through an exception workflow with an approver, it stops counting against the findings component until the exception expires. The finding stays visible, with the approver and the expiry date, so an auditor sees the decision rather than a silent suppression.
- Severity overrides re-rank. If a rule’s default severity does not match your risk model, override it for your tenant. The override applies to the penalty too, and it is logged.
- Connector outages lower health. A connector whose credentials expired or whose API rejected the last scan is inactive; the health component drops until it is repaired, which is why the dashboard shows connector health next to the score.
- Enabling a framework can lower the score. A newly enabled framework with many failing controls pulls the compliance average down. That is the point: the score reflects what you chose to be measured against.
What the score is not
- Not a breach probability. Nothing in the formula estimates likelihood. It counts open, evidenced misconfigurations and control gaps.
- Not a cross-company benchmark. We do not compare your tenant with other tenants, and the score is not adjusted for industry or size.
- Not a certificate. An “A” under the ISO 27001 mapping means the mapped controls’ policies pass in the connected apps; it says nothing about the controls that live outside those apps.
Why we publish the formula
An auditor, a customer or a board can recompute the number from the findings list and the weights above. When a score changes between two reports, the scan diff shows exactly which findings appeared, were fixed, or were excepted, and the arithmetic follows.
This also settles a question that comes up in procurement: the EU AI Act’s transparency obligations apply to AI systems. Black Cat’s checks are not an AI system — they are explicit rules, and the score is arithmetic over their results — so there is nothing to disclose about a model, and no “explainability” layer to bolt on. The explanation is the rule, and you can read it.
See the full set of checks in the Policy Catalog, how they map to compliance frameworks, and how the mapping feeds the DORA Register of Information.