Scoring
See how AYAsec turns scan findings into severity counts, weighted scores, and readable security grades for each target.
Every scan produces a numeric score (0-100) and a letter grade (A+ through F). The same grade bands and deduction model apply to every scan type, so a B in DNS means the same thing as a B in TLS.
Grade bands
How deductions work
Each scan starts at 100 and loses points per finding, based on severity:
- Critical : −20
- High : −10
- Medium : −5
- Low : −2
- Info : no deduction
Info-level findings are informational only - they show up in the Full report view but never affect the score. Some scan types add their own scoring nuances on top of this base model: Ports, for example, adds a small penalty once the number of open ports exceeds a threshold, independent of any single port's severity.
The Overall score
A target's Overall grade is a weighted average of its five core scan scores - it is not the worst of the five, and it's not a simple average either:
- HTTP : 30%
- TLS : 20%
- Ports : 20%
- DNS : 20%
- Credibility : 10%
Only scan types that have actually been run for a target contribute to its Overall score; the remaining weights are redistributed proportionally rather than counted as zero. Discovery isn't part of this composite - see Scan Types for why.
- CISA KEV - a CVE confirmed as actively exploited in the wild (per CISA's Known Exploited Vulnerabilities catalog) adds a flat −15 penalty, regardless of its CVSS severity.
- EPSS - FIRST.org's predicted probability that a CVE will be exploited in the next 30 days adds −5 at 50%+ probability, or −10 at 90%+.
A high-severity CVE with no exploitation signal costs −10; the same CVE confirmed in KEV with a 95% EPSS score costs −35. Both signals are visible per-CVE on the report's Vulnerabilities section.
History
Every completed scan is stored, so a target's score and grade history is always available for that scan type - useful for confirming a fix actually landed, or spotting when a score regresses between runs.