| Frequency | Score Multiplier | Typical Use Case | |-----------|----------------|-------------------| | Continuous (daily) | 100 | Bug bounty + DAST in CI/CD | | Monthly | 80 | Critical APIs / public apps | | Quarterly | 60 | Internal infrastructure | | Bi-annually | 40 | Non-critical internal systems | | Annually | 20 | Low-risk assets | | Less than annually | 0 | None |
| Level | Description | Score | Example Techniques | |-------|-------------|-------|--------------------| | 1 | Automated scanner only | 20 | Nessus, OpenVAS | | 2 | Manual authenticated scanning | 40 | Burp Pro with manual verification | | 3 | Hybrid (automated + manual) with business logic | 60 | OWASP top 10 + custom exploits | | 4 | Adversary simulation (TTP-based) | 80 | MITRE ATT&CK mapping, C2 frameworks | | 5 | Full red team + purple team + zero-day research | 100 | Custom implants, physical, social engineering | indexof ethical hacking
| Metric | Weight | Formula | |--------|--------|---------| | Critical findings closed within SLA (e.g., 7 days) | 50 | (closed on time / total critical) × 50 | | High findings closed within SLA (e.g., 30 days) | 30 | (closed on time / total high) × 30 | | Reopened findings rate | -20 | subtract (reopened / total closed) × 20 | | Frequency | Score Multiplier | Typical Use
R = max(0, critical_score + high_score - reopened_penalty) Assesses the process quality, not just technical results. not just technical results.
