How the maturity score is calculated
Atlas assigns each scan a maturity score between 0 and 100, with a grade from A to E. The formula is public: you can check what the number measures and what it does not.
The weight of each finding
Each finding gets a priority score: severity multiplied by exploitability (EPSS probability, presence in the KEV catalogue) and by exposure. A critical vulnerability, exploited in the wild and reachable from the Internet therefore weighs more than information with no evidence of exploitation.
The formula
The score starts at 100 and removes the observed risk relative to the number of assets:
- risk budget: 10 points per observed asset (100 points for ten assets);
- risk: sum of the priority scores of the findings;
- score: rounding of 100 minus 100 times the risk divided by the budget, bounded between 0 and 100.
Two comparable scans therefore change in an explainable way: removing a finding raises the score by 100 times its priority score divided by the budget, and adding it lowers the score by the same amount.
The grades
| Score | Grade |
|---|---|
| 90 to 100 | A |
| 75 to 89 | B |
| 60 to 74 | C |
| 40 to 59 | D |
| 0 to 39 | E |
When the score is incomplete
Atlas never shows a misleading zero. The score is reported as “Incomplete” when the data is insufficient: no asset discovered, DNS resolution failed, the port scan missing or failed, or the EPSS and NVD enrichment incomplete. These cases show the absence of a score, not a bad score.