Posture score

What it measures

Most posture scores in this category are either black-box vendor metrics or maturity-model self-assessments. Neither is useful for a board conversation. Radius360's posture score is a weighted blend of six measurable program signals, each derived from data already in your tenant. There's no proprietary scaling — the formula is public and the math runs against rows you can audit yourself.

The single number lives at the top of the sidebar, on the dashboard hero card, and in every board report. It updates as your data does. The trend line answers the question every board asks: are we improving?

The formula

The posture score is a weighted sum of six sub-scores, each on a 0–100 scale:

posture_score = 0.30 × compliance_pct
              + 0.25 × risk_score
              + 0.15 × task_score
              + 0.15 × evidence_score
              + 0.10 × policy_score
              + 0.05 × incident_score

Result is rounded to a whole number 0–100. Source of truth is the ensure-posture-snapshot edge function; snapshots are stored in security_posture_snapshots with the methodology version that produced them.

Sub-scores

Compliance % (30%)

Average of completed_controls / total_controls across all activated frameworks for the tenant. If you've activated SOC 2 and ISO 27001, this is the mean of both readiness percentages. Frameworks you haven't activated don't count.

Risk score (25%)

Computed against the open risk register:

risk_score = max(0, 100 − (criticals × 15 + highs × 8 + others × 3))

Critical and high are 4×4-matrix risks of score ≥ 12 and ≥ 8 respectively. "Others" is every other open risk. Risks with status Mitigated, Accepted, or Closed are excluded.

Task score (15%)

Mitigation task hygiene:

task_score = max(0, 100 − (overdue × 10 + open_others × 3))

If you have zero open tasks, this defaults to 100 — the system can't penalize you for nothing. Overdue is past due_date and not yet completed.

Evidence score (15%)

Active evidence ratio: active_evidence / total_evidence × 100. Active means status pass or active (i.e., not stale, expired, or failed). Tenants with no evidence at all score 0 here — empty inventory is a signal.

Policy score (10%)

active_policies / total_policies × 100. Drafts and retired policies drag this down. Tenants with no policies score 0.

Incident score (5%)

incident_score = max(0, 100 − open_incidents × 15)

Counts incidents in status open or investigating. Closed/resolved incidents don't drag the score down — they were handled.

Why these weights

• Compliance (30%) dominates because audit readiness is the most externally observable governance outcome. When a buyer's CTO asks "are you SOC 2 ready?" — this is the answer.
• Risk (25%) is second because unmitigated criticals are the loudest signal of program weakness. A high compliance % that hides three open criticals is a fragile state.
• Task (15%) + Evidence (15%) measure operational follow-through. Are owned tasks actually moving? Is evidence still fresh, or collected once and let to rot?
• Policy (10%) is weighted lower because policies are leading indicators (you can have great policies and still be insecure) and lighter than execution metrics.
• Incident (5%) gets a small weight because incidents are point-in-time, not posture trends. A single bad week shouldn't tank a multi-quarter program. The weight is non-zero so an open critical incident still shows up.

Methodology versioning

Snapshots store the methodology version they were computed under (scoring_methodologies table). When the formula changes, historical snapshots stay accurate to their original inputs — there's no silent drift in the trend chart. If you compare two periods, the chart annotates which version produced each point.

The current version is v1.0. Material changes to weights or formulas increment the version number and re-render the trend with a visible breakpoint.

What it isn't

• Not a maturity model. NIST CSF maturity tiers, CMMC levels, and ISO 27001 process maturity are different scales. The posture score is operational, not aspirational.
• Not a regulatory grade. A 92 doesn't mean "audit will pass." The framework readiness sub-scores under Compliance Frameworks give you that granularity per framework.
• Not benchmarkable in absolute terms. A SaaS startup at 78 may be in a stronger position than a regulated financial firm at 85, because the framework set is different. Use the trend line, not the absolute number, to evaluate progress.
• Not a security score in the traditional sense. It's a governance program score. Are you running the program well? Different question from "is the network secure?" — though they correlate.