> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# About health score
> Understand how endpoint, policy, and control health scores are calculated from detected risks and how endpoint telemetry contributes to overall security posture assessments.
## Overview
Health score provides a measurable view of the security and compliance state of managed endpoints. It is calculated using information collected from risk factors associated with the policies assigned to each endpoint.
When an endpoint is online, collected telemetry and risk factor data are transmitted to the server at predefined intervals. If an endpoint is temporarily offline, collected data is stored locally and automatically transferred when connectivity is restored. Once the server receives updated information, risk scores, policy health scores, control health scores, and endpoint health scores are recalculated.
This approach ensures that security posture measurements accurately reflect the latest available endpoint state while minimizing the impact of intermittent connectivity.
## Data Collection and Synchronization
### Online Endpoints
When an endpoint is online:
* Risk factor data is collected continuously or at scheduled intervals.
* Probe results are transmitted to the server automatically.
* Health scores are recalculated when updated information is received.
### Offline Endpoints
When an endpoint is offline:
* Collected information is stored locally on the endpoint.
* Health scores displayed in the platform remain unchanged.
* The last update timestamp reflects the most recent successful communication with the server.
* Stored data is transmitted automatically when the endpoint reconnects.
As a result, an offline endpoint may display historical health values until newer information becomes available.
## Health Rating Scale
To simplify interpretation, health scores are also displayed as letter grades representing the overall risk level.
| Grade | Risk Level | Health Score | Interpretation |
| ------- | ------------- | -------------------- | -------------------------------------------------------------------- |
| A | Low Risk | 90% or higher | Strong security posture with minimal detected risk. |
| B | Medium Risk | 65% to less than 90% | Moderate risk level with some issues requiring attention. |
| C | High Risk | 40% to less than 65% | Significant risks are present and remediation should be prioritized. |
| D | Critical Risk | Less than 40% | Serious security gaps or compliance issues require immediate action. |
| Unknown | N/A | N/A | Insufficient information is available to calculate the health score. |
For display purposes, health scores are rounded to the nearest whole percentage.
Health scores should be reviewed alongside policy, control, and risk factor details to understand the specific issues affecting security posture and to prioritize remediation efforts effectively.
## Risk Calculation
Each risk factor produces a probe value and has an associated severity defined within the policy.
The risk value of an individual risk factor is calculated as:
```text theme={"system"}
rᵢ = vᵢ × sᵢ
```
Where:
* `rᵢ` = Risk value of the risk factor
* `vᵢ` = Probe value (0–100)
* `sᵢ` = Risk factor severity within the policy (0–1)
## Policy and Control Risk Calculation on Endpoint
For each policy and each control on endpoint, an aggregate risk score is calculated using all applicable risk factors.
The calculation combines:
* The highest detected risk factor
* The average contribution of all detected risks
Formula:
```text theme={"system"}
R = a × max(rᵢ) + b × (Σ rᵢ / Σ sᵢ)
```
Where:
* `R` = Policy or Control Risk
* `rᵢ` = Individual risk factor risk values
* `sᵢ` = Risk factor severity
* `a + b = 1`
Default weighting:
```text theme={"system"}
a = 0.25
b = 0.75
```
This approach balances the impact of the most severe risk with the overall concentration of risk across the endpoint.
### Policy Health Score
The Policy Health Score represents the overall health of a policy for a specific endpoint.
It is calculated as:
```text theme={"system"}
Policy Health = 100 - R
```
Where:
* `100` represents a fully healthy state.
* `R` represents the calculated policy risk.
Higher values indicate better compliance with the policy and fewer detected risks.
#### Example
Let's a policy contains four risk factors:
```text theme={"system"}
Factor 1: v₁ = 100, s₁ = 1.00
Factor 2: v₂ = 100, s₂ = 0.50
Factor 3: v₃ = 0, s₃ = 1.00
Factor 4: v₄ = 0, s₄ = 0.25
```
Step 1: Calculate individual risk factor values
```text theme={"system"}
r₁ = 100 × 1.00 = 100
r₂ = 100 × 0.50 = 50
r₃ = 0 × 1.00 = 0
r₄ = 0 × 0.25 = 0
```
Step 2: Calculate policy risk
Using the default weights:
```text theme={"system"}
a = 0.25
b = 0.75
```
The policy risk formula is:
```text theme={"system"}
R = a × max(rᵢ) + b × (Σrᵢ / Σsᵢ)
```
Substituting the values:
```text theme={"system"}
max(rᵢ) = 100
Σrᵢ = 100 + 50 + 0 + 0 = 150
Σsᵢ = 1.00 + 0.50 + 1.00 + 0.25 = 2.75
```
```text theme={"system"}
R = 0.25 × 100 + 0.75 × (150 / 2.75)
R = 25 + 0.75 × 54.55
R = 25 + 40.91
R = 65.91
```
Step 3: Calculate policy health
```text theme={"system"}
Policy Health = 100 − R
Policy Health = 100 − 65.91 and round it to the integer
Policy Health = 34%
```
Step 4: Determine the health grade
```text theme={"system"}
34% < 39.5%
```
The policy receives:
```text theme={"system"}
Grade D (Critical Risk)
```
### Control Health Score
Control Health is calculated using the same methodology as Policy Health, but only risk factors associated with the specific control are included in the calculation.
## Endpoint Health Score
Each endpoint receives an overall Health Score representing its combined security posture.
The Endpoint Health Score is calculated as the average of all assigned Policy Health Scores.
```text theme={"system"}
Endpoint Health =
Average(Policy Health Scores)
```
* An endpoint may have multiple assigned policies.
* Policies with an **Unknown** health score are excluded from the calculation.
* Only policies with valid calculated scores participate in the average.
* The endpoint health score remains unchanged while the endpoint is offline.
* Once updated telemetry is received, the platform recalculates all related scores.
## System-Wide Health Scores
The platform also calculates aggregate health scores across all endpoints.
### Policy Health
For each policy, the system-wide health score is calculated as:
```text theme={"system"}
Average(
Policy Health Score
across all endpoints
)
```
This provides an organization-wide view of compliance with a specific policy.
### Control Health
Similarly, each control receives a global health score:
```text theme={"system"}
Average(
Control Health Score
across all endpoints
)
```
This enables organizations to identify which security domains require additional attention or remediation.
## Event-Based Risk Factors and Health Scores
Some risk factors are event-based and automatically reset their probe values at midnight according to the endpoint's local time zone.
For event-based risk factors, the reset occurs locally on the endpoint at midnight. However, the updated values become visible in the platform only after the endpoint successfully reports updated information to the server.
As a result:
* The event reset occurs locally on the endpoint.
* If the endpoint is online at midnight, the updated risk values and resulting health scores are reported and reflected in the platform shortly after the reset occurs.
* If the endpoint is offline at midnight, the reset still occurs locally, but the platform continues displaying the last known values.
* Health scores will not be updated until the endpoint reconnects and synchronizes its latest data with the server.
* Offline endpoints may temporarily display historical event-based risks and health scores that no longer reflect the endpoint's current state.
This behavior ensures that health scores always reflect the most recently reported endpoint data while supporting devices that may be temporarily disconnected from the network.
## Key Considerations
* Health scores provide a standardized way to measure and compare security posture across endpoints, policies, controls, and the organization as a whole.
* A declining health score often indicates emerging risks, while improving scores demonstrate the effectiveness of remediation efforts.
* Health trends are often more valuable than individual scores because they reveal long-term improvements, recurring issues, and changes in security posture.
* Policy and control health scores help identify which security domains contribute most to overall organizational risk.
* Health scores should always be analyzed together with the underlying risk factors to understand the root causes of security and compliance gaps.
* Continuous monitoring enables security teams to prioritize remediation efforts, measure progress, and demonstrate security improvements over time.
## Related
Deploy, license, and configure Endpoint Security Posture Management (ESPM) to begin monitoring.
Monitor your endpoint security posture through widgets that highlight overall health, endpoint group health, active risk factors, and more.
Identify endpoints with critical health scores, review the risk factors contributing to their condition, and access remediation guidance.
Review historical endpoint health trends, policy assignment changes, and risk factor activity to understand how an endpoint's security posture has evolved over time.