What counts toward your score
Your security score measures how exposed you are, across five categories: endpoint protection, identity & access, device hardening, known exploited vulnerabilities and Microsoft 365 configuration. How the number is worked out (what a finding costs, the known-exploited-vulnerability cap, accepted risk) is in How your score is calculated.
This page covers what can see each category. A category only counts when something you connected can see it: a category none of your tools can see is shown as Not measured and left out of the score, never counted as a perfect 100. Within a category, each device or user is assessable only when a connected tool reports on it.
Capabilities
Each integration counts toward one or more capabilities. A capability makes your devices or users covered for it: Clariti knows which tool is responsible and can report the gaps. Some capabilities also come with evidence (for example "this sensor is healthy"), which is what makes a device pass or fail.
| Capability | What it means | Evidence that passes or fails |
|---|---|---|
| EDR | An endpoint protection agent runs on each device | Agent or sensor health |
| MDM | Devices are enrolled in and managed by the tool | None: coverage only. A managed device with no EDR agent is reported as an endpoint protection gap |
| Identity | Your people sign in through this directory | None: coverage only (identity coverage gaps) |
| MFA | The tool records each user's multi-factor enrollment | MFA enrollment |
| Disk encryption | The tool reports whether each device's disk is encrypted | Encryption status |
| Patching | The tool reports when each device was last patched | Last patch date or compliance state |
Built-in integrations
These integrations are built and maintained by Clariti. They count toward the capabilities below as soon as they are connected.
| Integration | Counts toward |
|---|---|
| Microsoft 365 | EDR, MDM, Identity, MFA, Disk encryption, Patching |
| Google Workspace | Identity, MFA |
| Okta | Identity, MFA |
| Duo Security | MFA |
| Active Directory (on-prem) | None |
| Microsoft Intune | MDM, Disk encryption, Patching |
| CrowdStrike Falcon | EDR |
| SentinelOne | EDR |
| Sophos Endpoint | EDR |
| Jamf Pro | MDM, Disk encryption, Patching |
| Cisco Meraki | None |
| Fortinet | None |
Microsoft 365 is one connection for several Microsoft services: Entra ID (identity and MFA), Intune (MDM, encryption and patching) and Defender for Endpoint (EDR). Integrations listed as "None" still add assets and context, such as network devices, but no score capability.
Custom (AI-built) connectors
When you build a connector for any other tool with the AI connector builder, Clariti proposes what the tool provides from its API, using the same capabilities.
Declared vs measured
For each capability, the confirm step shows its evidence status:
- Measured: the connector reads the tool's own evidence for that capability, such as an agent's health or a device's encryption status. Your devices or users pass or fail on it, exactly as with a built-in integration.
- Declared only: the tool provides the capability, but its API does not return the evidence. Your devices or users count as covered (they are not reported as a coverage gap), but they never pass or fail on it. MDM and Identity are always declared only, because they are coverage capabilities.
Clariti never invents evidence. If the tool does not report a value for a device, that device stays not assessable for that measurement.
Nothing counts until you confirm
A custom connector's capabilities count only after you confirm them. When a build finishes, the summary asks "This tool provides: ... Is that right?" with the proposed capabilities checked. Uncheck anything that is wrong, then confirm. You can review or change your answer later from the connector's card on the Integrations page, or choose Stop counting.
- Confirming MDM, disk encryption or patching (without EDR) puts that connector's devices in the endpoint protection check: any of them without an EDR agent will count against your score, the same way devices managed by Intune do. A connector you confirm as EDR covers its own devices.
- A capability you uncheck stays off for that connector, even if the connector is later repaired.
- You are asked again if the connector's declaration ever grows to include something you have not confirmed. Until then, it does not count.
- A paused or deleted connector stops counting at the next scoring run.
A custom connector never takes over a built-in integration: if it reports the same source as a built-in integration (for example a connector named "Intune"), the built-in integration's capabilities apply.