---
title: "How the Watcher posture score is calculated"
description: "Seven weighted categories, published weights and a deterministic calculation. Here is what goes into the number, and what never does."
url: https://buguardian.com/en/blog-how-the-watcher-posture-score-works.html
updated: 2026-11-03
---
Product · 3 Nov 2026 · 2 min read

# How the Watcher posture score is calculated

Seven weighted categories, published weights and a deterministic calculation. Here is what goes into the number, and what never does.

Most security reports end with a long list. The Watcher posture score ends with one number from 0 to 100 that a board, an auditor and an IT team can all read the same way. This post explains how that number is built.

## Seven categories, published weights

No service is a score on its own. Each one feeds a risk category, and the categories carry different weights because they contribute differently to enterprise risk.

| Category | Weight | What it measures |
|---|---|---|
| Technical vulnerability | 30% | Findings from network vulnerability scans |
| Human factor | 20% | Phishing simulation results |
| Data leakage | 15% | Breach records found by threat intelligence |
| Web vulnerability | 10% | Findings from web vulnerability scans |
| Firewall posture | 10% | Findings from firewall analysis |
| Identity and directory health | 10% | Findings from Active Directory health checks |
| Operational continuity | 5% | Expired certificates and endpoint weaknesses |

A score of 71 to 100 is **good**, 41 to 70 is **medium** and 0 to 40 is **critical**.

## Four rules that keep the score honest

1. **Deterministic.** The same measurements always produce the same score.
2. **No penalty for what you did not buy.** A service outside your scope does not lower the score.
3. **No double counting.** Only the last completed scan of each scope counts, and the same finding is counted once.
4. **Change is measured scan to scan.** An asset that was not assessed is never reported as resolved.

## What happens to a blind spot

A category that is not measured is not scored as zero. It is flagged as a visibility gap, and its weight moves to the measured categories. If web vulnerability is not measured, its 10 points are spread across the rest: technical vulnerability goes from 30 to 33, human factor from 20 to 22, and so on.

That is why every report states which categories were measured, which were out of scope and which have stale data. A score from a limited assessment is not a statement of full coverage.

## The maths sets the score. The AI tells the story.

Watcher does not calculate the score. The number comes from open, repeatable rules, so an auditor can check it. Watcher reads the result, explains which findings drive it and writes the priority actions in plain language. If the AI service is unavailable, the calculated score does not change.

You can try the weight redistribution yourself on the [posture score page](https://buguardian.com/en/posture-score.html#explorer).

[All updates](https://buguardian.com/en/updates.html)

## See it on *a live tenant.*

We walk you through the findings table, the posture score, the Watcher briefing and the report your management would receive.

[Book a demo](https://buguardian.com/en/demo.html)
[More updates](https://buguardian.com/en/updates.html)