The Security Score in Catcher provides a quick, comprehensive view of your organization's overall security posture. It combines three key metrics into a single score ranging from 0 to 100, where higher scores indicate better security.

![](https://support.catcher24.net/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBKUT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--25ad7e215d42859af70c6c2a15a3532e67263853/Screenshot%202025-08-18%20at%2016-51-35%20Dashboard_spotlight.png)

---

## How the Security Score Is Calculated

The score is a weighted sum of three components:

* Vulnerability Risk Score (VRS) – 60% weight

* Behavior Risk Score (BRS) – 25% weight

* Endpoint Protection Score (EPS) – 15% weight

### Formula

```
Security Score = (VRS × 0.6) + (BRS × 0.25) + (EPS × 0.15)
```

If **Phished integration** or **ESET integration** is not configured, their weights are **redistributed proportionally** among the remaining components to maintain a total weight of 100%.

---

## Component Breakdown

### Vulnerability Risk Score (VRS)

Assesses the severity of vulnerabilities in your environment.

* **Penalty per vulnerability:**

  * Critical: 40

  * High: 20

  * Medium: 5

  * Low: 1

* **Score normalization:**  
  Average penalty is normalized against a max of 120.

* **Score caps based on highest severity:**

  * Critical: max 50

  * High: max 70

  * Medium: max 85

  * Low: max 95

  * No vulnerabilities: **100**

---

### Behavior Risk Score (BRS)

Derived from the **Phished integration**.

* If configured, score is fetched directly (0–100).

* If not configured, BRS is excluded from the calculation.

### Endpoint Protection Score (EPS)

Evaluates ESET endpoint protection and update status.

**Formula:**

```
EPS = ((Protected / Total) × 0.6 + (Updated / Total) × 0.4) × 100
```

* If not configured, EPS is excluded from the calculation.

---

## How to Improve Your Catcher Security Score

Improving your Catcher Security Score means strengthening your organization's overall cybersecurity posture. Since the score is based on three components—**Vulnerability Risk Score (VRS)**, **Behavior Risk Score (BRS)**, and **Endpoint Protection Score (EPS)**—you can target improvements in each area:

### Vulnerability Risk Score (VRS) – 60% Weight

This is the most heavily weighted component, so reducing vulnerabilities has the biggest impact.

**Steps to improve:**

* **Patch critical and high vulnerabilities promptly.** These carry the highest penalties.

* **Conduct regular vulnerability scans** to identify new issues early, or do this automatically by scheduling your scans.

* **Implement automated patch management** to reduce manual effort and delays.

* **Remove or isolate unused or legacy systems** that may introduce risks.

### Behavior Risk Score (BRS) – 25% Weight

This score comes from the **Phished integration**, which assesses user behavior around phishing threats.

**Steps to improve:**

* **Enable and configure the Phished integration** if not already done.

* **Identify and report our phishing simulations** in your email client.

* **Train your security awareness** by completing security awareness training.

### Endpoint Protection Score (EPS) – 15% Weight

This score reflects how well your endpoints are protected and updated via **ESET integration**.

**Steps to improve:**

* **Ensure all endpoints have ESET protection installed.**

* **Keep endpoint protection software up to date.**

* **Automate updates and protection checks** to maintain coverage.

* **Monitor for unprotected or outdated devices** and remediate quickly.

### If Integrations Are Missing

If either Phished or ESET integrations are not configured, their weights are redistributed. This means the remaining components become even more critical to your score.

**Tip:** Configuring all integrations ensures a balanced and accurate score—and gives you more control over improvements.