> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/security-posture-rating-spr.md).

# Security Posture Rating (SPR)

The **Security Posture Rating (SPR)** is a unified score designed to provide a clear, measurable view of your organisation's overall security maturity. It is calculated out of a maximum of **1000 points** and combines insights from two core modules within CybaOps:

* **Vulnerability Manager** (max: 250 points)
* **Security Assessment** (max: 750 points)

This combined approach ensures that both **technical risk** **exposure** and **process maturity** are reflected in a single, actionable metric.

<figure><picture><source srcset="/files/XX8RXTu62hfiWOKMCCkS" media="(prefers-color-scheme: dark)"><img src="/files/PWFG9LFRTA8DWhXcn5Dd" alt=""></picture><figcaption></figcaption></figure>

## <mark style="color:$primary;">How the Score is Calculated</mark>

### <mark style="color:$primary;">1. Vulnerability Manager Contribution (max: 250 points)</mark>

The Vulnerability Manager evaluates your current exposure to known vulnerabilities across your environment.

* You start with a **baseline of 250 points**
* Points are deducted based on the severity of identified vulnerabilities:

| Severity | Deduction per Vulnerability |
| -------- | --------------------------- |
| Critical | -100 points                 |
| High     | -25 points                  |
| Medium   | -2 points                   |
| Low      | -0.5 points                 |

* Deductions continue until a maximum of **250 points** has been removed.
* If **no vulnerabilities are present,** the full 250 points are retained.

{% hint style="info" %}

#### **Example**

**1 Critical + 2 High + 5 Medium**

\= 100 + 50 + 10 = **160 points deducted**

\= Vulnerability score: **90 / 250**
{% endhint %}

### <mark style="color:$primary;">2. Security Assessment Contribution (max: 750 points)</mark>

The Security Assessment evaluated how well your organisation aligns with industry best practices across multiple security domains.

Each section is **weighted based on its impact on overall security risk.**

#### *<mark style="color:$primary;">High-Impact Sections (Heavily Weighted)</mark>*

* Vulnerability Management
* Risk Management
* Identy and Access Management

#### *<mark style="color:$primary;">Lower-Impact Sections (Lightly Weighted)</mark>*

* Supply Chain Security
* Incident Management

Each section is scored individually based on its level of alignment with recognised standards. These sections score are then weighted and combined to determine how many points are awarded out of the **maximum 750.**

{% hint style="info" %}

#### Key Principle

The better aligned your organisation is with best practices, the more of the 750 ponts you will earn.
{% endhint %}

## <mark style="color:$primary;">Final Score Calculation</mark>

Your **Security Posture Rating** is the sum of both components:

```
SPR = Vulnerability Manager Score (max 250)
    + Security Assessment Score (max 750)
```

**Maximum Possible Score: 1000**

## <mark style="color:$primary;">What Your Score Means</mark>

<table><thead><tr><th width="140">Score Range</th><th>Interpretation</th></tr></thead><tbody><tr><td>800-1000</td><td>Strong security posture with mature controls and low exposure</td></tr><tr><td>500-799</td><td>Moderate posture with some gaps requiring attention</td></tr><tr><td>0-499</td><td>High risk with significant vulnerabilities or control weaknesses</td></tr></tbody></table>

## <mark style="color:$primary;">Key Takeaways</mark>

* The SPR balances **real-world risk (vulnerabilities)** with **security maturity (processes and controls).**
* Eliminating vulnerabilities has an immediate and measurable impace on your score.
* Improving governance, identity controls, and risk management will significantly increase your assessment contribution.
* Not all security domains are equal - focus on **high-impact areas first** for the greatest improvement.

## <mark style="color:$primary;">Improving Your Security Posture Rating</mark>

To increase your SPR:

1. **Remediate Critical and High vulnerabilities first**
2. **Strengthen high-weighted assessment domains:**
   1. Identity & Access Management
   2. Risk Management
   3. Vulnerability Management processes
3. **Continuously reassess and monitor** your environment


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/getting-started/security-posture-rating-spr.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.