Severity and score

This page describes the three numbers you meet in Ctadel: the severity of a finding, the risk of an attack path, and the dashboard score.

The severity scale

Every finding carries one of four severity levels, shown as "Critical", "High", "Medium" and "Low". Lists sort in that order, from most to least serious, and put a finding with an unknown severity last. A fifth level, "Info", exists for a few good-practice rules with no security stake, for example the absence of a lifecycle rule on a bucket.

Severity is not computed on the resource: it comes from the rule, or from the vulnerability catalogue.

A severity is changed by changing the rule, under "Policies": the next finding will carry it. It is not changed finding by finding.

The risk score of attack paths

Only attack paths carry a risk score, from 1 to 100, shown in the "Risk" column of the "Toxic Combinations" page and used to sort it. It combines three factors that severity alone does not see.

• Exposure: is the first resource of the path reachable from the Internet.
• Exploitability: does it carry an exploitable weakness. For a vulnerability, the probability comes from EPSS, raised when the CVE is in the KEV catalogue or used by ransomware; the CVSS attack vector tells a network-reachable flaw from a local one.
• Data: does the target hold data classified as sensitive, an admin identity, a key or a control plane.

For a computed path, the score is the path's probability multiplied by the value of its target, scaled to 100. For a catalogue chain, it starts from a base per severity and is adjusted by these three factors. The Attack paths page gives the exact values and the severity thresholds.

The dashboard score

The "Security Score" card on the overview shows a number from 0 to 100. It counts only open toxic combinations, weighted by severity, against the number of resources in the displayed scope:

weighted = 10 × critical + 5 × high + 2 × medium + 0.5 × low
score    = round(100 / (1 + weighted / max(1, resources)))

A scope with no open toxic combination scores 100, whatever the number of other findings. The card's "How is the score computed?" button shows the detail: the number of paths per severity, the weighted total, the resource count, the ratio and the score. The score turns green from 80 and red below 50.

The score follows the project selector in the header: it is computed on the resources and paths of the chosen scope.

The history

Below the score, a curve shows how it moved over the last 30 days; the "Findings Trend" and "Findings status over time" cards show, for the same window, the number of open findings and the number of closed or ignored findings per day, and each finding family has its own trend by severity.

These curves are not snapshots recorded every day. They are recomputed at each display from the dates every finding already carries: its discovery date and, when it is closed, its resolution date, or failing that the date of the event that ignored or accepted it, or failing that its last observation. A finding counts as open on day D when it was found on or before D and was not closed on that day. This is why every status change is logged with its date.

Limits

• The dashboard score ignores findings that are not attack paths: an instance with many configuration findings but no toxic combination scores 100.
• For past days, the score history uses today's resource count, not the count of that day.
• Findings found before the 30-day window enter the baseline of the first day; the history goes no further back.
• The "Info" level is not part of the scale used for sorting and histories: an "Info" finding is treated there as unknown severity.
• The severity of a vulnerability depends on the synced NVD catalogue: a CVE the catalogue does not know yet has no severity.
• The risk score exists only for attack paths; other findings have a severity only.