Security GPA

Security GPA provides an overall assessment of your environment's internal and external security posture. Like a grade point average, a higher Security GPA indicates a stronger security posture.

Security GPA is based on the number and severity of vulnerabilities detected in your environment. Changes to individual asset ratings can affect the overall Security GPA, allowing you to track changes as vulnerabilities are resolved.

Security GPA also considers the relative importance of assets. Assets that are more important to your organization can be weighted more heavily than less critical assets.

How is Security GPA calculated?

Security GPA is the weighted average of your asset ratings. By default, Fortra VM On-Premises weights an asset’s risk based on your environment such as a servers or workstation.

If an asset belongs to more than one asset group, Fortra VM On-Premises uses the group with the highest risk weight when calculating Security GPA. This allows you to assign broader weights by asset type while giving additional weight to assets that are especially important to your organization.

See related: Asset Groups

Security GPA ratings

Rating	Description
	The weighted average of your asset ratings is 0.00–0.33.
	The weighted average of your asset ratings is 0.34–0.67.
	The weighted average of your asset ratings is 0.68–1.00.
	The weighted average of your asset ratings is 1.01–1.33.
	The weighted average of your asset ratings is 1.34–1.67.
	The weighted average of your asset ratings is 1.68–2.00.
	The weighted average of your asset ratings is 2.01–2.33.
	The weighted average of your asset ratings is 2.34–2.67.
	The weighted average of your asset ratings is 2.68–3.00.
	The weighted average of your asset ratings is 3.01–3.33.
	The weighted average of your asset ratings is 3.34–3.67.
	The weighted average of your asset ratings is 3.68–4.00.

Vulnerability severity levels

A vulnerability is a weakness in an asset's hardware, software, or configuration that an attacker might exploit. Fortra VM On-Premises determines vulnerability severity based on the potential effect on confidentiality, integrity, and availability.

Severity Level	Description
	If exploited, a critical vulnerability can allow an attacker to gain complete control of the affected asset. Publicly available exploits may require little or no specialized knowledge to use. In some cases, the presence of a critical vulnerability can indicate that the asset is already compromised. Resolve critical vulnerabilities immediately.
	If exploited, a high-severity vulnerability can allow an attacker to gain user or administrative access to the affected asset, run commands, access or delete files, or launch attacks against other assets. Exploitation may require specialized knowledge, and publicly available exploits may not exist. Resolve high-severity vulnerabilities as soon as possible.
	If exploited, a medium-severity vulnerability can provide information that helps an attacker gain access to the asset. Medium-severity vulnerabilities can result from improperly configured services, weak or missing security settings, or unprotected limited-access accounts. Address these vulnerabilities promptly.
	If exploited, a low-severity vulnerability can expose information that might not be sufficient to access the asset. You can often address low-severity vulnerabilities by applying security-hardening practices or disabling unnecessary services.
	If exploited, a trivial vulnerability can expose information that is unlikely to provide access to the asset. Some trivial vulnerabilities cannot be remediated because of operating system limitations and pose minimal risk to the asset.
	Information reported by an asset or service that is not considered a vulnerability.

Asset Ratings

Fortra VM On-Premises an asset rating based on the highest-severity vulnerabilities detected on the asset.

Asset ratings use a compliant-by-default model, which means the rating is based only on vulnerabilities detected during scans. Information-only scan policies, such as host discovery or port scans, can result in an A rating because they do not identify vulnerabilities that lower the rating.

During an individual scan, the asset rating reflects vulnerabilities detected by that scan. Active View provides an aggregate rating based on vulnerabilities detected across scans for that asset.
See related:Active View

Rating	Description
	The asset has one or more critical-severity vulnerabilities.
	The asset has one or more high-severity vulnerabilities.
	The asset has one or more medium-severity vulnerabilities.
	The asset has one or more low-severity vulnerabilities.
	The asset has no vulnerabilities above the trivial severity level.

Cloud GPA

Fortra VM On-Premises aggregates anonymized tenant data to provide a comparison between your Security GPA and other organizations using the platform.

To configure SLA GPA:

1. Select Scan Settings > Settings.

2. Under Matching and Trending, enable Use SLA Security GPA.

3. In SLA Security GPA days, enter the number of days before vulnerabilities are included in Security GPA calculations.