The posture index and change alerts

How the 0–100 posture index is calculated and which changes trigger an alert.

After each successful monitoring run, Verisight records an unchangeable posture snapshot with a posture index from 0 to 100. Higher is better.

How it's calculated (methodology v1.0.0)

Each open finding subtracts points according to its severity:

Each penalty is scaled by the finding's confidence: penalty × (0.5 + 0.5 × confidence). A finding at 100% confidence counts fully, and one at 0% counts half. The total penalty is capped at 100, and posture index = 100 − total penalty.

Example: one high finding at 80% confidence (15 × 0.9 = 13.5) plus two medium findings at 100% (8 + 8 = 16) gives a penalty of 29.5, so a posture index of 70.5.

The index is a way to communicate and prioritise. It is not a certification or a universal security score. Business context, such as how critical an asset is or compensating controls, isn't part of v1. The methodology version is stored with every snapshot, so a future change never silently rewrites your history.

Failed runs never improve your score

A failed or incomplete run creates no snapshot. Findings that are missing because collection didn't complete can never make you look better.

When you get an alert

You are alerted when, compared with the previous run of the same monitor:

• the index falls by 10 points or more, or rises by 10 points or more; or
• the number of critical or high findings goes up or down.

Smaller score movements and changes limited to medium, low or info findings are recorded in history but don't alert. The first run is your baseline and never alerts. To avoid noise, repeat alerts in the same direction are suppressed for 24 hours per monitor.

History

The Monitoring page shows your latest index, the recent trend, finding counts and whether the latest run was a meaningful improvement or deterioration. A monthly view shows the latest snapshot of each month.