Skip to content

SCARP methodology

Prioritization should explain the path, not hide it behind a number.

SCARP uses scores to support a decision. The graph, evidence, ownership, and retest state remain inspectable beside the result.

01

Evidence before severity

An observation keeps its source, timestamp, affected asset, and replayable context.

02

Paths before queues

Connected control gaps and reachable impact outrank isolated finding volume.

03

Closure before credit

A remediation changes status only after the original route is retested.

Illustrative scorecard

AA grade, Low exposure, Monitor.
SCARP Scorecard
SCARP methodology

Illustrative score-only view. The score translates into a remediation priority; production calls also gate on risk tier, actionable critical findings, and scan coverage.

872
AA
grade
LowLow exposure
PriorityMonitor
Posture breakdown11 posture dimensions
  • Exposure surface85
  • Vulnerability severity79
  • Certificate hygiene87
  • Service exposure72
  • DNS posture83
  • Email security77
  • Software exposure75
  • Attack-path risk67
  • Third-party exposure64
  • Compensating controls81
  • Confidence86