Security GPA

Security GPA provides an overall assessment of your environment's internal and external security posture. Like a grade point average, a higher Security GPA indicates a stronger security posture.

NOTE: Security GPA uses a letter-grade and the GPA scale commonly used in U.S. schools. The letter E is omitted to avoid confusion with Excellent.

Security GPA is based on the number and severity of vulnerabilities detected in your environment. Changes to individual asset ratings can affect the overall Security GPA, allowing you to track changes as vulnerabilities are resolved.

Security GPA also considers the relative importance of assets. Assets that are more important to your organization can be weighted more heavily than less critical assets.

How is Security GPA calculated?

Security GPA is the weighted average of your asset ratings. By default, Fortra VM weights an asset’s risk based on your environment such as a servers or workstation.

NOTE: You can adjust an asset group's risk weight to increase or decrease its effect on Security GPA. A higher risk weight gives assets in that group more influence on the overall score.

If an asset belongs to more than one asset group, Fortra VM uses the group with the highest risk weight when calculating Security GPA. This allows you to assign broader weights by asset type while giving additional weight to assets that are especially important to your organization.

See related: Asset Groups

Security GPA ratings

Rating Description
The weighted average of your asset ratings is 0.00–0.33.
The weighted average of your asset ratings is 0.34–0.67.
The weighted average of your asset ratings is 0.68–1.00.
The weighted average of your asset ratings is 1.01–1.33.
The weighted average of your asset ratings is 1.34–1.67.
The weighted average of your asset ratings is 1.68–2.00.
The weighted average of your asset ratings is 2.01–2.33.
The weighted average of your asset ratings is 2.34–2.67.
The weighted average of your asset ratings is 2.68–3.00.
The weighted average of your asset ratings is 3.01–3.33.
The weighted average of your asset ratings is 3.34–3.67.
The weighted average of your asset ratings is 3.68–4.00.

Vulnerability severity levels

A vulnerability is a weakness in an asset's hardware, software, or configuration that an attacker might exploit. Fortra VM determines vulnerability severity based on the potential effect on confidentiality, integrity, and availability.

Severity Level Description
If exploited, a critical vulnerability can allow an attacker to gain complete control of the affected asset. Publicly available exploits may require little or no specialized knowledge to use. In some cases, the presence of a critical vulnerability can indicate that the asset is already compromised. Resolve critical vulnerabilities immediately.
If exploited, a high-severity vulnerability can allow an attacker to gain user or administrative access to the affected asset, run commands, access or delete files, or launch attacks against other assets. Exploitation may require specialized knowledge, and publicly available exploits may not exist. Resolve high-severity vulnerabilities as soon as possible.
If exploited, a medium-severity vulnerability can provide information that helps an attacker gain access to the asset. Medium-severity vulnerabilities can result from improperly configured services, weak or missing security settings, or unprotected limited-access accounts. Address these vulnerabilities promptly.
If exploited, a low-severity vulnerability can expose information that might not be sufficient to access the asset. You can often address low-severity vulnerabilities by applying security-hardening practices or disabling unnecessary services.
If exploited, a trivial vulnerability can expose information that is unlikely to provide access to the asset. Some trivial vulnerabilities cannot be remediated because of operating system limitations and pose minimal risk to the asset.
Information reported by an asset or service that is not considered a vulnerability.

Asset Ratings

Fortra VM an asset rating based on the highest-severity vulnerabilities detected on the asset.

Asset ratings use a compliant-by-default model, which means the rating is based only on vulnerabilities detected during scans. Information-only scan policies, such as host discovery or port scans, can result in an A rating because they do not identify vulnerabilities that lower the rating.

During an individual scan, the asset rating reflects vulnerabilities detected by that scan. Active View provides an aggregate rating based on vulnerabilities detected across scans for that asset.
See related:Active View

NOTE: You can adjust how much specific asset types (for example, printers) contribute to Security GPA by changing your asset-group weights. See related: Asset Groups
Rating Description
The asset has one or more critical-severity vulnerabilities.
The asset has one or more high-severity vulnerabilities.
The asset has one or more medium-severity vulnerabilities.
The asset has one or more low-severity vulnerabilities.
The asset has no vulnerabilities above the trivial severity level.

Cloud GPA

Fortra VM aggregates anonymized tenant data to provide a comparison between your Security GPA and other organizations using the platform. You can use Insight to narrow the comparison by industry or other peer groups.

SLA GPA

Organizations can define a grace period before newly identified vulnerabilities affect Security GPA. This can help align Security GPA with remediation processes that require change control, testing, or other internal procedures before remediation can be completed

To configure SLA GPA:

  1. Select Scan Settings > Settings.

  2. Under Matching and Trending, enable Use SLA Security GPA.

  3. In SLA Security GPA days, enter the number of days before vulnerabilities are included in Security GPA calculations.

Insight Peer Comparison

Insight Peer Comparison provides an on-demand view that compares your security posture with organizations in the same industry or of a similar size.