Scoring & confidence.
What the numbers on a verdict actually mean, and how disagreement between sources is represented rather than averaged away.
A verdict is derived, not stored
No connector writes a verdict directly onto an entity. Each contributes an evidence row, and the verdict is reconciled from those. That is what makes it possible to recompute a verdict when a source is re-graded, and to show why rather than just what.
The numbers
| Field | Range | Means |
|---|---|---|
confidence | 0.0 – 1.0 | How strongly the evidence supports the verdict |
relevance_score | 0 – 100 | Intrinsic importance: severity, recency and confidence combined |
admiralty_code | A1 – F6 | Source reliability and claim credibility, kept as separate axes |
cvss_v3 | 0.0 – 10.0 | Upstream CVSS base score, passed through unchanged |
epss | 0.0 – 1.0 | Upstream probability of exploitation in the next 30 days |
Severity is not risk
A critical CVSS score on something with no public exploit and no affected asset is not an emergency. Conversely a medium score that is on CISA KEV and present in your estate is. The platform keeps these signals separate rather than collapsing them into one number that hides the reasoning.
cvss_v3— how bad the flaw is in the abstract.epss— how likely exploitation is.- KEV membership — whether exploitation is observed, not predicted.
- Your own asset data — whether it applies to you at all.
Disagreement
When one feed says malicious and another says clean, both evidence rows are retained and both remain visible. The reconciled verdict reflects the weight of evidence, but the disagreement is not erased — an analyst deciding whether to block an address should be able to see that it was contested.
Relevance is currently intrinsic
relevance_score is an intrinsic 0–100: severity, recency and confidence of the item itself. It does not yet account for your sector, region or asset inventory, so it ranks what is objectively significant rather than what is significant to you. Per-tenant relevance is a later phase.