The Ward Score

The letter tells you how much attention you need to give it right now:

A90 to 100

Nothing of medium severity or above is open; what's left is minor. Keep monitoring and fix the rest when you have time.

B80 to 89

No high or critical findings, but there are medium ones. Plan them: they are what keeps you from an A.

C65 to 79

One or two high findings, or several medium ones adding up. Fix the high ones this week.

D50 to 64

Three or more high findings, or many problems across several areas. Set time aside this week to bring it down.

E35 to 49

Many serious problems at once, though none critical (a critical one always puts you in F). Start with the most severe.

F0 to 34

A critical finding is open (it always lands here) or there are too many serious ones. Act today on the critical ones.

Ward groups its checks into 5 categories. Each category starts at 100, and every open finding takes off a percentage according to its severity.

• The deductions multiply: ten minor warnings are not the same as one serious problem.

The Ward Score is the weighted average of the categories:

Email

25%

Website and certificates

20%

Exposed infrastructure

25%

Domain

10%

Reputation and impersonation

20%

What each finding takes off its category

Critical

45%

High

25%

Medium

10%

Low

3%

So that a good average can't hide a serious problem, the Ward Score has caps:

• With any critical finding, it can't go above 34 (F).
• With one high finding, above 79; with two, above 69; with three or more, above 59.
• With any medium finding, above 89.

In this example everything is perfect except one critical finding in exposed infrastructure.

• That category drops to 55 and the weighted average is still 89.
• But the cap brings the Ward Score down to 34.
• Fixing a serious problem lifts the cap: with three high findings, fixing one moves the cap up one step.

The Ward Score changes when a scan finds something different, not when you open the dashboard.

It goes up when:

• You fix a finding and Ward confirms it in the next check.
• You mark a finding as accepted risk, false positive or planned. That raises the number without removing the problem: do it only when it's true, and always leave a note.

It goes down when:

• A new problem appears: a new service reachable from the internet, a new vulnerability in software you already run, a lookalike domain, an account in a breach…
• A finding gets worse, for example because its expiry date gets closer.
• The date of a planned fix, or the review date of an accepted risk, passes and the finding is still there.
• A resolved finding comes back.

A drop you didn't cause is normal. Open Activity to see exactly what the last scan found.

• Findings you mark as accepted risk or false positive.
• Findings with a planned fix, until the planned date (if they're still there after it, they count again).
• Resolved findings.
• Informational findings.
• Findings in the same group (for example, all the vulnerabilities of one product on one address, or all the lookalike domains) count as one: the worst.

Start with what's critical and high: those set the caps, and they are the quickest way up.

• Ward's Overview lists them first under “Start with these”.
• Each finding tells you exactly what to do.
• When you fix one, mark it as “Pending verification”. Ward checks it, and your Ward Score goes up on the next scan.