Vetora Risk Score methodology
The A–F score shown on every report summarizes a set of detected findings into a single grade. This page explains exactly how it's calculated — and, more importantly, what it does not represent.
What this score is not
The Vetora Risk Score is a methodology proprietary to Vetora — a way of weighting and summarizing the findings we ourselves detected, not a certification, not an industry standard, and not a score validated by an independent third party. A B score does not mean "72% secure" or any percentage-based measure: it's a letter grade, like a school grade, that summarizes a weighted judgment on what we found — nothing more, nothing less. An A site can have a vulnerability we failed to detect; a D site can be more solid overall than it looks if the findings are already being fixed (see the status section below).
1. Weight by severity
Every detected finding has a severity, which determines its starting weight in the calculation (the score starts at 100 points, each active finding subtracts from it):
| Critical | 40 points |
| High | 20 points |
| Medium | 8 points |
| Low | 3 points |
| Info | 0 point (never counted) |
2. Harmonic decay
Distinct findings of the same severity don't add up linearly (except critical findings, see below). The first counts in full, the second counts for half, the third for a third, and so on. One missing security header genuinely costs -8 points; four missing headers cost about -16.7 points (8 + 4 + 2.7 + 2), not -32. The idea: several configuration-hygiene issues of the same type shouldn't, on their own, produce the same grade as a single real vulnerability.
Before this calculation, findings describing the same underlying issue (e.g. three different cookies missing the Secure attribute) are grouped and counted once, at their highest still-active severity.
3. The critical floor
Critical findings don't go through the decay above: every distinct critical check counts in full and adds up with the others — an exposed Stripe secret key AND an exposed Supabase service_role key both count at 100%, they don't dampen each other. And most importantly: as long as at least one critical finding remains open or merely reviewed (not yet fixed nor its risk accepted), the grade can never exceed D, whatever the rest of the calculation yields. An exposed secret key must never get buried in a good average.
4. A finding's status changes its weight
| Open / Reviewed | 100% of weight |
| Risk accepted | 25% of weight |
| False positive | 0% (excluded) |
| Fixed | 0% (excluded) |
Marking a finding as "reviewed" doesn't change the score — having looked at it doesn't make it any less real. Only an explicit decision (risk accepted, false positive) or an actual fix changes the grade.
The A–F thresholds
| A | 90 points or more |
| B | 75 to 89 points |
| C | 60 to 74 points |
| D | 40 to 59 points |
| F | under 40 points |
The point count itself is never shown anywhere on the site — deliberately, so as not to imply a precision ("87/100") the model isn't meant to offer. Only the letter is shown.