También en español: rosmarops.com/es/blog/como-funciona-la-nota-de-exposicion/
Publishing that my machine scored 18 out of 100 has an obvious problem: 18 out of what? If I read that on someone else’s blog, the first thing I’d want to know is how it’s calculated, and whether I could do the maths myself. If I can’t, the number isn’t worth much. So here is all of it: what each thing weighs, the formula, and what’s left out.
RosmarOps doesn’t give the machine a score. It gives one to each agent. Claude Code has its own Agent Posture Score, and so does Cursor. Scores go from 0 to 100, and higher is better. The score never contradicts the agent’s own traffic light, because that agent’s worst finding sets the band and the score moves inside it. Red runs from 0 to 49 (Exposed), yellow from 50 to 79 (Open gaps) and green from 80 to 100 (Contained).
I wanted it that way. A report that says “red” at the top and “72” underneath makes no sense to me. A 79 is still yellow. It isn’t “nearly fine”: it still has gaps.
What each thing weighs
Each finding adds a weight, and they don’t all weigh the same. The red ones weigh the most:
- a high-privilege credential the agent can read and send out: 20;
- being able to change another agent’s configuration: 15;
- being able to change its own configuration: 15;
- a high-privilege credential saved in a git repository: 20, or 30 if that repository has a remote.
The yellow ones come below:
- a medium credential it can read and send out (or one RosmarOps can’t classify), or a high-privilege one it can only read: 8;
- another agent’s instructions it can rewrite: 6;
- its own instructions: 4;
- a medium credential saved in git: 8.
Three more details. If a credential finding reaches any project, not just one, its weight is multiplied by 1.5. A credential in git counts in every agent’s score, because it doesn’t depend on any agent. And medium credentials an agent can read but has no way to send out aren’t findings, but each adds 2.
There are two things I chose to keep out of the weight. The first is confidence. When RosmarOps has to assume something, it says so, but an assumption doesn’t make the exposure lighter. Lowering the weight whenever it isn’t certain would be cheating. The second is the number of copies: the same finding in 27 projects weighs the same as in one, because how far it reaches is already counted.
The maths
Add up the weights: that’s P. Inside the band, the score falls as P grows:
score = bottom of the band + width of the band × 80 / (80 + P), rounded down.
The widths are 49 for red, 29 for yellow and 20 for green.
Put like that it’s dry, so here’s a made-up agent. It has four findings:
- a high-privilege credential reachable from any project (30);
- write access to another agent’s configuration (15);
- a medium credential reachable from any project (12);
- its own instruction files (4).
That adds up to 61. Red band, score 27. Fix only the high-privilege credential and it goes to 35. Fix everything and it goes to 100.
The formula has three properties I cared about more than the exact number. Fixing something never lowers the score, and adding a problem never raises it. Because it’s rounded down, a small fix doesn’t always change the number when a lot is left. And 100 only happens when nothing was found.
In my case, the setting the report suggested would take me from 18 to 22. Four points, and still red. That seems fair to me: one setting doesn’t fix a machine.
What doesn’t count
Some settings look like a fix and only go halfway. If a setting narrows the exposure but, according to the vendor’s own documentation, doesn’t close it, the score doesn’t move. The report tells you what is still open. I’d rather have a score that stays put than one that rises for something that closes nothing.
The formula is versioned. If I ever change a weight, the report separates what changed on your machine from what changed in the method. And when the agents evaluated change, or the number of projects drops by more than 10%, it says the two runs are not comparable. The score is for comparing yourself with yourself, not with anyone else.
And it doesn’t measure everything. It leaves out agents RosmarOps doesn’t evaluate yet, what an agent does while it runs (it only reads configuration at rest), what an MCP tool does internally, and the Windows credential store. That’s why a 100 means one thing: no exposure found in what was read. Nothing more.
I wrote this with AI assistants. The machine, the findings and the decision to publish are mine.