PatchFirst
Rating and global rating
The rating shows detected risks; the global rating accounts for the share of software checked.
Rating
The main rating from 0 to 100 and its letter grade describe checked components. Higher scores mean less detected risk. This rating sets the report verdict and color. P0–P3 priorities help order updates.
The assessment reflects the collected software list and available vulnerability information at the time of the check. It does not guarantee the absence of every threat.
Global rating
The global rating appears alongside an asterisk. The checked share receives the main rating; the unchecked share receives 50 points for unknown risk.
Example: rating 90 / 100
Global rating 70 / 100* · 400 of 800 components checked
coverage = checked / total
global_score = round(score × coverage + 50 × (1 − coverage))When the main rating is above 50, the unknown share lowers the global score. When the main rating is below 50, the global score can be higher. At full coverage both ratings match and use the same letter scale.
“Unchecked” does not mean “vulnerable”: there is not enough information for comparison yet. If the server’s installed package list was not collected, both ratings show “?”. A cluster is assessed using its discovered programs and nodes.
The fleet global rating uses the same weights as the main rating: a server with role prod has weight 2; others have weight 1. Servers rated “?” are excluded from the average and fleet coverage.
What coverage counts
Coverage is the number of checked components compared with all discovered components. We count installed packages, application dependencies, standalone programs and container images. Repeated copies of the same dependency or image count once.
A package is checked when its version is compared with vulnerability information. This includes builds from third-party repositories and packages of unknown origin: when the product is recognized and its exact version is known, it is checked against the product developer’s data. The package and the product identified within it are not counted twice.
For a container, we check the recognized program with an exact version. Unrecognized images and images without an exact version remain unchecked. Hidden image contents do not add invented components. A cluster node without a package list contributes one unchecked operating system.
We check the running system kernel. Old inactive kernels and their supporting files are outside coverage. A detected vulnerability does not reduce coverage: the component was checked and the result affects the rating. Hidden low-risk findings without a fix do not reduce coverage either.
Unchecked components may include custom packages, programs without a version, unrecognized products, versions that could not be compared, and components whose data sources are temporarily unavailable. Reasons appear in a collapsed section at the bottom of the report; the free check does not reveal names or versions.
How to improve coverage
- Collect a fresh list of installed software and exact versions using the agent.
- Use exact container versions rather than changing labels. Check the servers running them separately.
- Clarify unknown versions and check again after data sources recover. Address detected threats in the priority order shown in the report.