How the Security Posture Score works

The score in one paragraph

Your Security Posture Score is a number from 0 to 100 built from two ingredients: what our external scan observed about your public website and public records, and what you told us about your internal practices in the self-assessment. Before you complete the self-assessment, the score is 100% tool-observed. After, it blends 60% tool-observed + 40% self-reported. Reports always label which is which — we never present your own answers as something we verified.

Tool-observed checks and weights

Each check earns full points when passing, half points when partially in place (where partial credit applies), and zero when it's a gap. The section score is points earned divided by points possible, scaled to 100.

What the website software check does not cover. It looks only at your public website — the software your site discloses about itself, and whether that exact version has publicly documented security flaws. It does not examine network services, remote-access tools, or any device on your office network. And when your site keeps its version number private (which is a sensible default), we look nothing up and report no result rather than guess.

If we couldn't measure it, it doesn't count against you

Sometimes a check can't complete — our TLS check can't reach the site, a breach lookup is inconclusive, or a website hides its software version so there is nothing to look up. When that happens the check is marked “not measured” and removed from the denominator entirely. A scanner timeout is a fact about our scanner, not about your security, so it never lowers (or raises) your score, and we never raise an alarm about it.

Self-reported controls and weights

The self-assessment asks about practices no external scan can see — MFA, backups, training. “Yes” earns full points, “Partial” earns half, “No” and “Unknown” earn zero. These answers are yours: they appear in every report marked self-reported, never as verified findings. The four HIPAA controls below only appear for medical and dental practices.

Grades

What this score is not

• Not a certification. ClearScan shows where your public-facing posture stands. It does not certify you as secure or compliant with HIPAA or any other regulation.
• Not an internal audit.We only look at what's publicly visible — DNS, certificates, headers, and public breach data. We never access your systems, install anything, or handle patient or customer data.
• Not a guarantee. A high score means the common, externally visible weaknesses attackers look for first are addressed — it cannot rule out every possible risk.