Scores, findings, and coverage
Interpret the score, proof quality, stable rule identity, and audit limitations together.
Score and grade
VICE starts at 100 and subtracts versioned penalties from actionable findings. Critical costs 15 points, high 8, medium 3, low 1, and informational 0. The same rule can contribute at most three penalties so one noisy check does not dominate the result.
- A: 90 to 100.
- B: 75 to 89.
- C: 60 to 74.
- D: 40 to 59.
- E: 20 to 39.
- F: 0 to 19.
Severity describes impact
- Critical: immediate, highly damaging risk supported by strong evidence.
- High: serious risk that should be remediated quickly.
- Medium: meaningful weakness with moderate impact or reach.
- Low: limited risk or a narrow hardening opportunity.
- Info: context or coverage signal with no score penalty.
Classification and confidence describe proof
Classification explains how the conclusion was reached. Confidence explains how reliably the evidence supports it. Neither replaces severity.
- Confirmed means VICE directly observed the relevant behavior or exposure.
- Probable means strong evidence supports the conclusion but one link remains inferred.
- Heuristic means a pattern suggests risk and needs manual confirmation.
- Hardening means a defensible improvement rather than a proven exploit.
- High, medium, and low confidence rank the reliability of the conclusion.
Read the finding anatomy
- Title and module identify the affected security area.
- Detail and evidence explain what VICE observed, with sensitive values masked.
- Recommendation gives a concrete remediation direction.
- Location connects local findings to a source path when available.
- Status records whether the issue remains open or was solved in Platform.
Rules, fingerprints, and coverage
The rule ID identifies the detection logic and supports grouping or policy. The fingerprint identifies a stable occurrence of that rule at a target or source location and powers baselines and diffs.
- Complete means the selected checks finished without a material limitation.
- Partial means useful evidence exists but one or more planned checks were limited.
- Incomplete means the result cannot represent the selected profile reliably.
Do not gate on the score alone
Check selected modules, excluded findings, coverage limitations, and version metadata before comparing or enforcing a score.
Continue with VICE
See how VICE turns evidence into findings and scores.