Scoring and attribution

This page describes the scorecard and the attribution labels.

Attribution

See Objects and terms for when a report appears and what ownership means.

Attribution confidence is a separate number from severity.

• Severity answers “how urgent.”
• Confidence answers “how sure we are this belongs as labeled.”

Low confidence still shows the row on Reports and Vendor Monitoring.

Vendor posture score

Vendor Monitoring shows a grade and a 0–100 score.

The formula:

1. Start at 100.
2. For each active incident, deduct severity × 2 × confidence weight.
3. Floor at 0.

Confidence weight:

exp(3 × (confidence − 100) / 100), then clamp to 0–1.

Confidence	Weight (approx.)
100	1.00
90	0.74
75	0.47
50	0.22
Missing	1.00

Missing confidence uses weight 1. Those rows have no confidence value.

Letter grades from the integer score:

Grade	Score
A	90–100
B	80–89
C	70–79
D	60–69
F	0–59

The grade is vendor posture.
On Reports and Exposures, set False positive or Remediated to close the row.
Vendor Monitoring is a separate view for supply-chain vendor risk.

The vendor detail page can show a weighted deduction chip on an incident.

Report severity labels

Reports filter severity as Low, Medium, High, or Critical.

Alert rules use the same labels. Numeric map:

Label	Number
Low	1
Medium	2
High	3
Critical	4

Exposure severity stays 0–10 on the Exposures page.

Evidence you can see

The dashboard shows:

• Repository link and file on Exposures
• Ownership, confidence, and the report body on Reports
• Incident summary, severity, confidence, and category on vendor detail

You decide from those fields.
The letter grade is extra posture context.