Scoring
How a learner's answers become the scores, levels and recommendations on their results page. Scoring is deterministic: the same answers to the same question bank always give the same result, and the AI never decides a score.
Answers
Each scored question's answers carry a value, and the chosen answer's value is its score. On the individual scale a question is worth 0 to 3; on the organizational scale, 0 to 5.
A learner can also answer in their own words. The AI then picks the answer that best matches what they wrote, and that answer is scored as if they had chosen it. If it can't tell with confidence after three attempts, the answer scores 0 (or "Not sure") rather than guessing.
Categories
Every scored question belongs to a category. A category's score is the sum of its answered questions' scores, out of the sum of their maximums.
| Category result | Classed as |
|---|---|
| 70% or more | A strength |
| 40% or less | A weak area |
| Below 70% | Gets a recommendation, if the catalog has an entry for it |
Scoping triggers
Answers to the scoping questions can change what is asked later:
- Exclude removes a category or question entirely. It is never asked and doesn't count towards any score or maximum. Someone with no business email isn't marked down on business email.
- Score zero keeps a question but scores it 0 whatever is answered.
Groups
Each category rolls up into one of four groups: Recognize, Verify, Protect and Respond. A group's score is the average of its categories' percentages, shown on the audience's scale (out of 3 or 5) to one decimal place.
Averaging percentages rather than adding up points keeps every category equal, whatever its number of questions: a category with eight questions doesn't outweigh one with two.
A category counts towards its group from the moment scoping leaves it in, answered or not. An unfinished group therefore scores lower than the same group finished, never higher.
A category that belongs to no group is listed on its own, under Other areas.
Maturity level
The overall maturity level comes from the learner's total score as a percentage of the total possible, rounded down to a whole number. For example, 2 out of 3 is 66%, which is Intermediate, not Advanced.
| Individual scale | Percentage |
|---|---|
| None | 0% |
| Basic | 1 to 33% |
| Intermediate | 34 to 66% |
| Advanced | 67 to 100% |
| Organizational scale (NIST CSF) | Percentage |
|---|---|
| None | 0% |
| Initial | 1 to 20% |
| Repeatable | 21 to 40% |
| Defined | 41 to 60% |
| Managed | 61 to 80% |
| Optimizing | 81 to 100% |
Recommendations
Each category below 70% gets the recommendation entry of the same name, weakest category first. A category with no entry of that name gets no recommendation. If nothing is below 70%, or nothing below 70% has an entry, the learner gets their audience's general resources instead.
If the learner gave a reason for their visit, recommendations for the categories it mentions move to the front and are marked as matching it. The reason only reorders recommendations: it never adds or removes one. If the learner says a scam has already happened, recovery recommendations lead.
The written summary at the top of results names the learner's two lowest groups, skipping any already at 70% or more.
Retakes
A learner retakes the knowledge and tools questions (stage 2) to confirm progress on a roadmap. The scoping answers are carried over from the original assessment, so the same questions apply and the two results compare like for like. A roadmap only counts a level as earned once a retake's scores have actually risen.