Cloud Cyber Hygiene Scoring(CCHS) Approach

Cyber Hygiene Scoring is a quantitative method used to evaluate how well an organization follows cybersecurity best practices. It provides a clear and measurable indicator of the organization’s exposure to risks based on various factors, such as system configuration, patch management, access control, endpoint protection, and compliance adherence.

The scoring model converts complex security metrics into an easy-to-understand score, typically ranging from 0 to 100 or represented in grades like Poor, Fair, Good, and Excellent. This simplifies the process of tracking progress over time and benchmarking performance against industry standards.

Saner Cloud offers a comprehensive Cyber Hygiene Scoring (CCHS) framework designed to help organizations measure and monitor their cloud security posture. The scoring consists of three components: Raw Score, Global Score, and Local Score, which together provide a complete assessment of risks across cloud environments.

To get started, users can access CHS from the CNAPP Infra(organization) or account level dashboards to gain deeper insights. At the organizational level, users can track their overall security posture, review cyber hygiene across various accounts, assess risk distribution among different cloud providers, and more. At the account level, users can access detailed insights, including the distribution of cyber hygiene scores across cloud environments, module-wise risk analysis, key issues leading to score decreases, security details at the resource level, and more.

Saner Cloud also enables organizations to analyze risks from multiple perspectives. This includes identifying high-risk resources based on their geo-location, evaluating service-level risks through CHS scores, assessing resource health by severity, monitoring trends in resource risk, and analyzing changes in cyber hygiene scores over time. These features allow organizations to identify vulnerabilities, prioritize remediation efforts, and effectively strengthen their overall cloud security posture.

The Cyber Hygiene Score framework utlilizes three key scoring mechanisms: Raw Score, Global Score, and Local Score, to assess the security posture of a resource.

Raw Score

A Raw Score is a measure of a resource’s total attack surface that is independent of context. It is calculated across four dimensions: misconfigurations (Cloud Security Posture Management – CSPM), posture anomalies (Cloud Security Posture Anomaly – CSPA), missing patches (Cloud Security Risk Management – CSRM), and identity-related issues (Cloud Infrastructure Entitlement Management – CIEM). The score can theoretically range from 0 to infinity. Users have the flexibility to assign custom weightings to each dimension, with the default setting being 25% for each. A higher Raw Score indicates greater exposure and lower security for the resource.

Global Score

The Global Score is a standardized metric that is derived from the Raw Score and is inversely related to it. It ranges from 0 to 100, but in practice, it usually falls between 0.96 and 99.6. A higher Raw Score leads to a lower Global Score, indicating a decrease in the security of the resource.

A score of 100 is deliberately excluded, as no resource can ever be considered 100% secure in real-world scenarios.

Local Score

Local Score is a percentile-based metric that reflects a resource’s security posture in relation to other similar resources within a specific account. It is derived from an inverse transformation of the Raw Score, meaning that as the Raw Score increases, the Local Score decreases, indicating weaker security. Since the Local Score is dependent on the account, the same resource can have different Local Scores across different accounts. The most secure resource is assigned a score of 100, while the least secure receives a score of 0.

How Saner Cloud Computes the Cyber Hygiene Score?

The Cyber Hygiene Score (CHS) for a resource is calculated as a weighted average of its Global Score and Local Score, with default weightings of 80% for the Global Score and 20% for the Local Score. The Global Score indicates the overall security posture of a resource, while the Local Score evaluates it in comparison to similar resources within the same account.

Together, these scores provide a comprehensive view of both absolute and relative security. The CHS typically ranges from 0.96 to 99.6, with higher scores signifying stronger security hygiene.

Score Range	Risk Level	Interpretation
0-10	Critical Risk	The organization’s security posture is extremely weak. Most cyber hygiene controls are missing or ineffective. Immediate and comprehensive remediation is required to prevent breaches.
10-20	Very Poor	Security posture is severely weak. Core hygiene practices like patching, access control, and configuration management are largely neglected. Urgent action is needed to reduce exposure.
20–30	Poor	Foundational security measures are inconsistent or poorly implemented. The environment remains at significant risk. Strengthen endpoint protection, update policies, and enforce compliance.
30–40	Below Average	Some basic controls exist, but many misconfigurations continue to exist. The system lacks regular monitoring and timely remediation. Focus on automating hygiene tasks and addressing recurring issues.
40–50	Fair	The organization has made some progress, but notable weaknesses remain. Implement continuous assessment, improve patch cadence, and tighten configuration baselines.
50–60	Average	Core hygiene practices are functional but not optimized. Security gaps exist due to inconsistent execution. Focus on proactive maintenance and periodic risk reviews.
60–70	Good	The cybersecurity hygiene is strong and reasonably consistent. Minor issues are present but do not pose major threats. Continue periodic audits and awareness programs.
70–80	Very Good	Most systems are well-maintained, with a strong culture of security hygiene. Only minor process or configuration improvements are required. Maintain routine monitoring.
80–90	Outstanding	The organization demonstrates excellent cyber hygiene maturity. Controls are effectively managed and continuously improved. Maintain the current strategy and validate resilience regularly.
90–100	Excellent	A model of cybersecurity excellence. Preventive and detective controls are optimized, and continuous improvement is embedded in operations. Sustain through ongoing innovation and threat intelligence integration.