A single score can be a useful index if its inputs, weights and limits are published, but it cannot fully summarise risk. Composites hide which factor drives them and can be raised by improving easy inputs. Show the score beside its components and never use it as the only gate.
Why people want one number
Executives, procurement and customers want quick comparisons. One number is easy to chart, rank and put in a contract clause. That demand is legitimate. The problem is what the number silently decides.
What a composite hides
- Weights. Someone chose how much dependency age counts against exposure. Different weights give different rankings.
- Offsetting. A great result in one area can mask a severe weakness in another.
- Coverage. A score computed over the assets you scan says nothing about the rest.
- Direction. Two applications with the same score can have opposite problems.
- Staleness. The score's date is often missing.
FIRST makes a similar point about CVSS: base scores measure severity and should not be used alone to assess risk, and numerical scores should be labelled with the metric groups used. A composite needs that same labelling discipline.
Gaming a composite
If a composite becomes a target, effort goes to the cheapest inputs. A team can raise the score by closing many low findings, adding documentation checks or enabling an easy scan, while a severe flaw remains. Campbell's law, as commonly phrased, warns that indicators used for decisions invite distortion of the process they track.
Making a score honest
| Practice | Effect |
|---|---|
| Publish the inputs and weights | Readers can challenge them |
| Show component scores beside the total | Reveals offsetting |
| Cap the score when any critical condition holds | Stops averaging away a severe issue |
| Show coverage and last updated date | Prevents false assurance |
| Version the method and log changes | Keeps trends comparable |
| Give a rationale for each input | Keeps the score tied to outcomes |
The capping rule is especially useful: if a known exploited, reachable flaw is open on an exposed asset, the result should not read as healthy whatever else is true.
Steps to build or evaluate one
- List the decisions the score will inform. If none, do not build it.
- Choose a few inputs tied to outcomes: exposure evidence, time to fix, coverage.
- Set weights with a written reason, and test how rankings change under other weights.
- Add caps for severe conditions.
- Publish the method and a change log.
- Never use the score as the sole gate. Keep gates on specific conditions.
Using external scores
If a vendor or customer sends a score, ask for the method, the data date, the scope and the components. If they cannot supply them, treat it as an opinion.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a composite score worthless?
No. It is a helpful index when inputs, weights and limits are visible. It fails as a hidden verdict.
Should a score be a release gate?
Gate on specific conditions, such as new known exploited findings, not on a blended number.
Sources
Last reviewed: 19 October 2026.
