Skip to main content

​
Overview

Health score provides a measurable view of the security and compliance state of managed endpoints. It is calculated using information collected from risk factors associated with the policies assigned to each endpoint. When an endpoint is online, collected telemetry and risk factor data are transmitted to the server at predefined intervals. If an endpoint is temporarily offline, collected data is stored locally and automatically transferred when connectivity is restored. Once the server receives updated information, risk scores, policy health scores, control health scores, and endpoint health scores are recalculated. This approach ensures that security posture measurements accurately reflect the latest available endpoint state while minimizing the impact of intermittent connectivity.

​
Data Collection and Synchronization

​
Online Endpoints

When an endpoint is online:
  • Risk factor data is collected continuously or at scheduled intervals.
  • Probe results are transmitted to the server automatically.
  • Health scores are recalculated when updated information is received.

​
Offline Endpoints

When an endpoint is offline:
  • Collected information is stored locally on the endpoint.
  • Health scores displayed in the platform remain unchanged.
  • The last update timestamp reflects the most recent successful communication with the server.
  • Stored data is transmitted automatically when the endpoint reconnects.
As a result, an offline endpoint may display historical health values until newer information becomes available.

​
Health Rating Scale

To simplify interpretation, health scores are also displayed as letter grades representing the overall risk level. For display purposes, health scores are rounded to the nearest whole percentage. Health scores should be reviewed alongside policy, control, and risk factor details to understand the specific issues affecting security posture and to prioritize remediation efforts effectively.

​
Risk Calculation

Each risk factor produces a probe value and has an associated severity defined within the policy. The risk value of an individual risk factor is calculated as:
Where:
  • rᵢ = Risk value of the risk factor
  • vᵢ = Probe value (0–100)
  • sᵢ = Risk factor severity within the policy (0–1)

​
Policy and Control Risk Calculation on Endpoint

For each policy and each control on endpoint, an aggregate risk score is calculated using all applicable risk factors. The calculation combines:
  • The highest detected risk factor
  • The average contribution of all detected risks
Formula:
Where:
  • R = Policy or Control Risk
  • rᵢ = Individual risk factor risk values
  • sᵢ = Risk factor severity
  • a + b = 1
Default weighting:
This approach balances the impact of the most severe risk with the overall concentration of risk across the endpoint.

​
Policy Health Score

The Policy Health Score represents the overall health of a policy for a specific endpoint. It is calculated as:
Where:
  • 100 represents a fully healthy state.
  • R represents the calculated policy risk.
Higher values indicate better compliance with the policy and fewer detected risks.

​
Example

Let’s a policy contains four risk factors:
Step 1: Calculate individual risk factor values
Step 2: Calculate policy risk Using the default weights:
The policy risk formula is:
Substituting the values:
Step 3: Calculate policy health
Step 4: Determine the health grade
The policy receives:

​
Control Health Score

Control Health is calculated using the same methodology as Policy Health, but only risk factors associated with the specific control are included in the calculation.

​
Endpoint Health Score

Each endpoint receives an overall Health Score representing its combined security posture. The Endpoint Health Score is calculated as the average of all assigned Policy Health Scores.
  • An endpoint may have multiple assigned policies.
  • Policies with an Unknown health score are excluded from the calculation.
  • Only policies with valid calculated scores participate in the average.
  • The endpoint health score remains unchanged while the endpoint is offline.
  • Once updated telemetry is received, the platform recalculates all related scores.

​
System-Wide Health Scores

The platform also calculates aggregate health scores across all endpoints.

​
Policy Health

For each policy, the system-wide health score is calculated as:
This provides an organization-wide view of compliance with a specific policy.

​
Control Health

Similarly, each control receives a global health score:
This enables organizations to identify which security domains require additional attention or remediation.

​
Event-Based Risk Factors and Health Scores

Some risk factors are event-based and automatically reset their probe values at midnight according to the endpoint’s local time zone. For event-based risk factors, the reset occurs locally on the endpoint at midnight. However, the updated values become visible in the platform only after the endpoint successfully reports updated information to the server. As a result:
  • The event reset occurs locally on the endpoint.
  • If the endpoint is online at midnight, the updated risk values and resulting health scores are reported and reflected in the platform shortly after the reset occurs.
  • If the endpoint is offline at midnight, the reset still occurs locally, but the platform continues displaying the last known values.
  • Health scores will not be updated until the endpoint reconnects and synchronizes its latest data with the server.
  • Offline endpoints may temporarily display historical event-based risks and health scores that no longer reflect the endpoint’s current state.
This behavior ensures that health scores always reflect the most recently reported endpoint data while supporting devices that may be temporarily disconnected from the network.

​
Key Considerations

  • Health scores provide a standardized way to measure and compare security posture across endpoints, policies, controls, and the organization as a whole.
  • A declining health score often indicates emerging risks, while improving scores demonstrate the effectiveness of remediation efforts.
  • Health trends are often more valuable than individual scores because they reveal long-term improvements, recurring issues, and changes in security posture.
  • Policy and control health scores help identify which security domains contribute most to overall organizational risk.
  • Health scores should always be analyzed together with the underlying risk factors to understand the root causes of security and compliance gaps.
  • Continuous monitoring enables security teams to prioritize remediation efforts, measure progress, and demonstrate security improvements over time.

Getting started with ESPM

Deploy, license, and configure Endpoint Security Posture Management (ESPM) to begin monitoring.

Dashboard

Monitor your endpoint security posture through widgets that highlight overall health, endpoint group health, active risk factors, and more.

How to identify high-risk endpoints

Identify endpoints with critical health scores, review the risk factors contributing to their condition, and access remediation guidance.

How to analyze endpoint health trends

Review historical endpoint health trends, policy assignment changes, and risk factor activity to understand how an endpoint’s security posture has evolved over time.