Watcher posture score
A score you can explain to the person who pays for it.
From 0 to 100 across seven weighted categories. The weights are published, the calculation is deterministic, and the same finding is never counted twice. Same inputs, same score — every month, auditable.
Seven categories, published weights
No service is a score on its own. Each one feeds a category.
Categories do not contribute equally to enterprise risk, so their weights differ. The weights are transparent and shown in every report.
| Category | Weight | What it measures |
|---|---|---|
| Technical vulnerability | 30% | Findings from network vulnerability scans |
| Human factor | 20% | Phishing simulation results: who opened, who clicked, who submitted credentials |
| Data leakage | 15% | Breach records found by threat intelligence |
| Web vulnerability | 10% | Findings from web vulnerability scans |
| Firewall posture | 10% | Findings from firewall analysis |
| Identity and directory health | 10% | Findings from Active Directory health checks |
| Operational continuity | 5% | Findings that put day-to-day operation at risk: expired certificates, endpoint weaknesses |
Four rules
The rules that keep the score honest.
Deterministic
The same measurements always produce the same score. Findings are combined as risk probabilities: each additional finding of the same severity adds a little less than the one before, and a single critical finding still moves the number quickly.
No penalty for what you did not buy
A service outside your scope does not lower the score. A licensed service that has stopped sending data is flagged as a visibility gap, so a missing measurement never passes for a clean one.
No double counting
Only the last completed scan of each scope is counted, and the same finding is counted once — even when two engines report it.
Change is measured scan to scan
Every scan is compared with the previous scan of the same scope: newly detected, resolved, reappeared, ongoing. An asset that was not assessed is never reported as resolved.
Try it
See how a blind spot changes the weights.
Switch a category off to see its weight redistributed across the measured ones, or move a category score. This is a simplified illustration of the category roll-up with sample values — not your data.
Posture score
6 of 7 categories measured.
Example from the brochure: web vulnerability not measured, so its 10 points move to the others — 30→33, 20→22, 15→17, 10→11, 10→11, 5→6.
Score first, story second
The maths sets the score. The AI tells the story.
The score is calculated, not generated by the language model. Identical input produces identical output. Watcher does not determine the score; it explains the result, highlights priorities and turns technical findings into clear business language. If the AI service is unavailable, the calculated score remains unchanged.
- 01
Collect
Findings from every source are normalised into one schema; duplicates of the same issue are merged.
- 02
Measure
Each category is evaluated with its own weight; an unmeasured category's weight is redistributed.
- 03
Score
A single number from 0 to 100. Higher is better. The same input always yields the same score.
- 04
Explain
Watcher writes the rationale, the priority actions and the visibility-gap warnings in plain language.
Delta reporting
Not a snapshot. What changed.
Each assessment is compared with the previous one. The report moves from “what's there now” to “what changed”, so your team's work becomes measurable.
- Asset-level tracking. Change is tracked per IP address and per domain, not just in totals.
- A real trend. A 30-day trend built from daily measurements — never artificially smoothed.
For the board
One A4 page for the board.
Score, trend curve, prioritised actions and blind-spot warnings — written in plain business language and ready to hand to a director, an auditor or an insurer.
The score is not the whole story.
Every report states three facts alongside the number:
- Which categories were measured
- Which categories were excluded from scope
- Which categories have stale or missing data
Because unmeasured weight is redistributed, a score from a limited assessment can look like one from a full assessment. The posture score is not a statement of full coverage, not produced by AI, and not a certification or a guarantee of compliance.
Get your first posture score.
We map your external attack surface and produce your first Watcher posture score. You will see exactly how you look from the outside.