Overview
Every Exposure Report includes a Security Health Score that summarizes your organization's credential exposure risk in a single label. This guide explains how scores are calculated and what actions each level requires.
Score Levels
| Score | Label | Meaning |
|---|---|---|
| ≥ 70 | Critical | High volume of recently exposed credentials in active circulation. Immediate remediation is essential — compromised accounts may already be at risk of unauthorized access. |
| ≥ 40 | High | Significant credential exposures detected across multiple breach sources. Prompt password rotation and security audit recommended. |
| ≥ 20 | Medium | Moderate exposure detected. Credentials exist in breach databases, but the volume or recency is lower. Review and address affected accounts. |
| < 20 | Low | Minimal exposure. A small number of credentials found, often from older breaches. Continue monitoring. |
What Influences the Score
The risk score is determined by several factors:
- Total number of exposures — more compromised credentials increase the score
- Recency of the data — credentials found in recent stealer log dumps are weighted more heavily than years-old breach data
- Source diversity — credentials appearing in multiple independent sources indicate wider exposure and higher risk
- Leak type — stealer log entries (indicating malware on a device) are generally more dangerous than old combo list entries
Recommended Actions by Level
Critical (≥ 70)
- Immediately force password resets for all affected accounts
- Revoke all active sessions for compromised users
- Enable or enforce MFA on all services
- Investigate potential unauthorized access in system logs
- Scan employee endpoints for info-stealer malware
- Consider engaging an incident response team
High (≥ 40)
- Force password resets within 24 hours
- Enable MFA on all critical services (VPN, email, admin panels)
- Audit credential reuse across platforms
- Review email forwarding rules and OAuth app grants
Medium (≥ 20)
- Schedule password rotation for affected accounts within the week
- Review and strengthen password policies
- Implement or verify MFA deployment
- Educate affected employees about credential hygiene
Low (< 20)
- Address affected accounts during the next routine security review
- Continue monitoring for new exposures
- Use the results to justify security awareness training
Score Changes Over Time
For Pro Guard subscribers, each monthly report shows "New Since Last Report" — the number of additional exposures detected since the last scan. Track this number to assess whether your security posture is improving:
- Decreasing scores after remediation indicate that password resets and MFA enforcement are working
- Increasing scores suggest ongoing credential leakage, potentially from persistent malware or continued credential reuse