Why our score is out of 100 and not a traffic light
A colour tells you how to feel. A number tells you whether last month's work actually helped.
We get asked fairly often why we give a security score out of 100 rather than a red, amber or green light. Traffic lights are everywhere in this trade, they look reassuring on a dashboard, and they are easy to glance at. That is exactly the problem. A colour is a verdict, and a verdict does not tell you whether you are getting better or worse, only how somebody wants you to feel about it today.
A number moves. If you were on 61 last month and you are on 68 this month, the seven points came from something real - you turned on two-step sign-in, or you finally decrypted and wiped those old laptops. You can see the effort land. With a traffic light, the same work often leaves you stuck on amber, which quietly teaches people that the work does not matter. We think that is the worst lesson a security tool can teach.
A number is also honest about the middle. Most small businesses do not live at “safe” or “disaster”. They live in the long stretch between, where a few sensible changes genuinely move the needle and the rest can wait. A colour flattens all of that into one of three buckets. A score lets us say, plainly, “you are in reasonable shape, here are the three things that would move you furthest,” which is the conversation actually worth having.
We are not pretending the number is precise to the point. It is a considered judgement, weighted towards the things that cause real harm, and we would rather be roughly right and moving than exactly reassuring and stuck. If a colour ever helps you more than a trend does, tell us and we will show you both. But we will keep leading with the number, because it is the one that respects the work you put in.
- ✓Note your current score before you change anything this month.
- ✓Pick the three items flagged as highest impact and do those first.
- ✓Re-check the score after the changes to confirm they actually moved it.
- ✓Track the trend month on month rather than reacting to a single reading.
- Cyber security: measuring what matters for small firms NATIONAL CYBER SECURITY CENTRE ↗
- Cyber Essentials: the five controls that reduce risk most GOV.UK ↗
- Why security ratings can mislead buyers COMPUTER WEEKLY ↗
Links open each publisher’s live coverage of this topic.