How your score is calculated
Your Clariti score answers one question: how exposed are you right now? It runs from 0 to 100, and higher is safer. It is built from the open findings Clariti has on your environment, so the things on your findings list are the things that move your score, and fixing them is how you raise it.
The five categories
Every finding that affects your score belongs to one of five categories. Each category gets its own score out of 100, shown as a tile on your dashboard, and your overall score combines them. Endpoint protection and identity count the most, then device hardening, then known exploited vulnerabilities and Microsoft 365 configuration.
| Category | What it looks at | Examples of findings |
|---|---|---|
| Endpoint protection | Whether your devices have a working endpoint protection (EDR) agent | Devices with no EDR agent, unhealthy or disconnected agents |
| Identity & access | Your users and how they sign in | Users without multi-factor sign-in, standing admin roles, dormant accounts, MFA bypass codes, Conditional Access turned off |
| Device hardening | How well your devices are configured | Disks not encrypted, firewall off, no screen lock, unsupported operating systems, devices not patched in 30 days, devices not managed by an MDM |
| Known exploited vulnerabilities | Software on your devices and network equipment with vulnerabilities attackers are actively using | Devices running a version listed in CISA's Known Exploited Vulnerabilities catalog |
| Microsoft 365 configuration | Your Microsoft 365 tenant settings | Failed configuration checks, such as mailbox auditing off or anyone-links allowed in SharePoint |
How much a finding costs
Three things decide how much a finding lowers its category:
- Severity. A critical finding costs more than a high one, and so on down to low. Informational findings cost nothing.
- How much of your environment it touches. A problem on 40 of your 90 laptops costs more than the same problem on one laptop. Findings about your whole tenant, such as a Microsoft 365 setting, count as touching everything.
- Whether the exposure is confirmed. When Clariti can see the problem directly, it counts in full. When Clariti can only tell you might be exposed (for example, it cannot see which version of a product a device runs), it counts half.
One serious problem is always clearly visible in its category. Several problems in the same category keep lowering it, but a category never drops below 0.
Measured and not measured
A category only counts when something you connected can actually see it, and that source has reported recently:
- Endpoint protection, identity and device hardening need an integration that covers them and has synced successfully in the last 7 days.
- Known exploited vulnerabilities needs software inventory from your devices, or a connected Microsoft Defender or CrowdStrike integration.
- Microsoft 365 configuration needs a Microsoft 365 configuration assessment completed in the last 14 days.
A category nothing is looking at shows Not measured · connect followed by the integrations that would measure it. It is left out of your overall score. It is never counted as a perfect 100: having no findings because nothing is looking is not the same as being safe.
Connecting an integration can therefore lower your score at first. Clariti can now see problems that were there all along.
The known-exploited-vulnerability cap
A vulnerability that attackers are actively exploiting is the most urgent thing on any list, so it limits your whole score, not just its category.
When Clariti confirms that your devices run software with a vulnerability in CISA's Known Exploited Vulnerabilities catalog, your overall score is capped. How low the cap goes depends on how many of your devices are affected:
- one device out of a hundred barely changes anything;
- half your devices caps the score in the mid-70s;
- most of your devices caps it around 60, and every device around 50.
While the cap applies, your dashboard says so: Score capped at N until the vulnerability is fixed. Fixing other findings still counts, and their share is waiting for you, but your score will not rise past the cap until the exploited vulnerability is fixed. That is why Clariti puts it first in your plan.
The cap only applies to confirmed exposure: a source that assesses your devices one by one has named the exploited vulnerability on them. A possible exposure, where a product you run is targeted but no per-device source has confirmed it, or a vulnerability that is serious but not known to be exploited, counts in its category like any other finding.
Accepted risk still counts
The score measures exposure, and accepting a risk does not remove it:
| Finding status | Counts toward your score? |
|---|---|
| Open or in progress | Yes |
| Accepted risk | Yes, shown as accepted · still counts |
| Resolved, not yet verified | Yes, until Clariti confirms the fix |
| Resolved and verified | No |
| False positive | No |
When you mark a finding resolved, Clariti checks on its next sync that the problem is really gone. Once the source no longer reports it, the finding is verified and your score goes up. This is why a fix you just made can take until the next sync to show.
What moves your score
Raises it:
- Fixing findings, once Clariti verifies the fix. Findings show an estimate of what fixing them is worth, such as ≈+4. The estimate is approximate, and the recalculated score is always the real number.
- Fixing a known exploited vulnerability that is capping your score. This is usually the single biggest move.
Lowers it:
- New findings, or an existing finding spreading to more devices or users.
- Connecting an integration that can see a category for the first time.
Does not change it:
- Accepting a risk, assigning an owner or snoozing a finding.
- Marking a finding resolved before Clariti has verified the fix.
- Alerts and sign-in risk events, findings about inventory quality (such as stale assets), and network appliance findings. These still appear on your findings list, but they are not part of the score today.
Your score is recalculated after every sync.
When this scoring model started
Clariti used to score only coverage: how many devices had EDR, encryption and recent patches, and how many users had MFA. The exposure score replaced it. On the day it started, your history chart shows a marker:
New scoring model: now includes vulnerabilities and configuration
Days before the marker keep the scores they had at the time. Clariti does not compare scores across the marker, so the change of model never shows up as a drop or a rise: score explanations, weekly trends and alerts start fresh from that day.
October 2026: scoring model version 3. The constants did not change and no score moved. The model now tells a confirmed exploited vulnerability (a per-device source named it on your device) from a possible one (the product you run is targeted). The chart marks the day with:
Scoring model updated: scores before this day are not comparable
For which integrations can measure each category, see What counts toward your score.
Detection fixes that moved scores
October 2026: end-of-support operating systems. Clariti now checks each device's operating system against Microsoft's published Windows support dates, and treats a Mac as supported while it runs one of the three newest macOS versions, because Apple does not publish end-of-support dates. Before this fix, most Windows 11 and Windows Server devices were wrongly counted as running an unsupported operating system, so many fleets will see their Device hardening score rise. Some systems that were previously missed are now flagged, so fleets that have them may see this score fall: Windows 10 devices reported by endpoint tools such as SentinelOne, Sophos or CrowdStrike, Windows 7, Windows 8, Windows 8.1, Windows Server 2012 R2 and older, and macOS 13 and 14. Windows 10 devices on paid Extended Security Updates still count as unsupported. When Clariti cannot tell which edition of Windows 11 a device runs, it uses the later Enterprise and Education date, so a device is never flagged while it may still be supported. If you had marked the end-of-support finding as a false positive, accepted its risk, or resolved it yourself, Clariti reopened it once so the corrected check could look again; it closes on its own if none of your devices are affected. The scoring model itself did not change, so there is no model-change marker on your history chart.