# Security Rating

Every scan performed within AquilaX generates a significant volume of data — including scanner types, identified findings, severity levels, and the validation status of each result. To reduce this information overload and improve usability, AquilaX introduces the Security Rating mechanism.

This feature provides a consolidated summary of scan results through a single, intuitive interface. The Security Rating offers a high-level overview, enabling users to quickly assess the security posture of their application before diving into individual findings.

The rating is visualized as shown in the image below, with each rating tier mapped to a specific score range, as detailed in the following sections of this document.<br>

<figure><img src="https://53914109-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjAmSnvnfbHl4EDK56iDo%2Fuploads%2FXW90F4BZbp1SWO8ZuTvS%2FScreenshot%202025-12-30%20at%2016.52.12.png?alt=media&#x26;token=2a0a16b4-5dc7-4f3e-b1b9-e3a379fa1b8b" alt="" width="375"><figcaption></figcaption></figure>

Each repository begins with a baseline Security Score of 100. As issues are identified during scans, score deductions are applied based on the severity and classification of each finding. These deductions are calculated using a predefined scoring model that weighs the impact of vulnerabilities and misconfigurations.

The resulting score — after all deductions — is what determines the final Security Rating, as represented in the visual scale introduced above.

<table><thead><tr><th width="147.9921875">Issue</th><th width="298.5390625">Score Deduction</th><th>Notes</th></tr></thead><tbody><tr><td>Lines of Code</td><td>1 score x 1k Lines of Code</td><td>Upper limit 3 total. The reason behind score deduction on this is to cover TN not detected via automated-scan that is depended on the code size </td></tr><tr><td>Findings (Confirmed)</td><td>10 score per HIGH or CRITICAL<br>4 score per MEDIUM<br>1 score per LOW</td><td></td></tr><tr><td>Findings (Not-confirmed)</td><td>2 score per HIGH or CRITICAL<br>1 score per MEDIUM<br>0.2 score per LOW</td><td></td></tr><tr><td>Non Confirmed</td><td>1 score per each 10 findings not validated / confirmed yet</td><td>Penalize findings not triaged yet</td></tr><tr><td>License</td><td>5 scores for Free<br>3 scores for Premium<br>0 Scores for Ultimate</td><td>Penalized for reduced scanning capacity</td></tr><tr><td>Scanners</td><td>5 Score for each disabled scanner</td><td>Penalized for reduced scanning capacity</td></tr></tbody></table>
