A risk score is an opinion with a number attached
A finding you cannot open and check is a notification. What a security report owes you, and what a score quietly removes.
What a score is doing
A security dashboard tells you your posture is 73. Last month it was 68.
Consider what has actually been communicated. Somebody built a model, weighted some inputs, and rendered the result as a two-digit integer. The weighting is a set of judgements about relative severity — which is a real and necessary thing to have — and the number is those judgements with the reasoning removed.
That would be fine if the score were an entry point to the evidence. Usually it is the product. You cannot reconstruct which inputs moved, you cannot tell whether 73 means one serious problem or nine trivial ones, and you cannot establish whether the vendor's view of severity matches yours. The five-point improvement might be a fix your team shipped, a detector the vendor tuned, or a check that stopped running.
The deeper problem is what a score does to the conversation. It converts "here is a specific thing that is wrong" into "here is our assessment of you", and the second is not actionable. Nobody has ever fixed a 73. They fix the table that returns every row to an anonymous request.
The question that replaces it
One question, applied to any security tool's output, including ours:
Can I open the thing you are describing?
If the answer is yes, everything follows from it. You can confirm the finding is real, judge the severity yourself against your own context, verify the fix afterwards, and — importantly — catch the tool being wrong. If the answer is no, you have received a notification, and the only thing you can do with it is believe it or not.
Applied to the three things we look at, "yes" means something concrete:
- A credential in a bundle. The masked value, the chunk it appears in, the offset. You can fetch that file yourself and find the same string in ten seconds.
- A readable table. The request, and the rows it returned. You can make the same request with the same public key and see the same result.
- A refund that lost money. The charge, the refund, and the transfer with
amount_reversedat zero. Three objects, all in your own Stripe account, all fetchable by ID.
None of that requires trusting us. That is the entire point of it. A finding you can independently reproduce is one where our role was noticing, not asserting — and noticing is a service you can evaluate on its results rather than on our reputation.
Evidence travels; a score does not
There is a second reason to insist on it, which has nothing to do with vendors and everything to do with what happens after the finding. Evidence travels. A masked credential with a chunk and an offset can be pasted into a ticket and handed to whoever is on call, and they can act on it without reconstructing the reasoning or talking to the person who found it. A score cannot be delegated — it has to be re-derived by somebody senior enough to interpret it, which is precisely the resource that is scarce. Findings that can be handed over get fixed; findings that need interpretation queue behind the one person qualified to interpret them.
The same property is what makes disagreement possible. If a tool tells you a table is readable and shows you the request and the rows, you can look and say: that table is meant to be public, this is not a finding. You have corrected the tool, cheaply, and you can suppress it with confidence. Argue with a 73 and there is nothing to point at — you either accept the number or ignore the product, and it is easy to quietly choose the second.
A risk score is an opinion with a number attached. Evidence is something you can open.
Scores are not useless. Aggregated across a portfolio, tracked over quarters, they are a reasonable management artifact, and if you own forty services you need some way to decide which one to look at first. Just do not mistake the summary for the work. The number is where you start reading, not what you are supposed to act on — and any tool that will not show you what is underneath it is asking for a kind of trust it has not earned and cannot justify.