Scoring & grades

Scoring & grades

Reference for how BlackNoise scores and grades simulation results


This page is the single reference for the BlackNoise scoring model. The Dashboard, the campaign Synthesis and the other result views all rely on these definitions. For the statuses and the severity that feed the score, see  Event statuses & severity .


How events are scored

BlackNoise scores each event on two criteria:
  • Detection efficiency: the more effective the detection, the higher the score: an Alerted event scores more than a Logged one, which scores more than an Undetected one. A High severity event also scores more than a Low one, reflecting the priority on detecting the most characteristic malicious actions.
  • Detection context: the more information provided about the detection, the higher the score.
The maximum unit score is 12.5 points for a High event and 8.75 points for a Low event (Alerted status with all technical information provided). The overall score is the sum of event points, reported on a 0–100 scale against the maximum achievable:
sum of event points × 100 / (High events × 12.5 + Low events × 8.75)


Simulation grade

A letter grade from E to A+ is assigned from the overall score.
A grade is also computed for each of the three Simplified Kill Chain phases.


Simplified Kill Chain

BlackNoise groups the MITRE ATT&CK tactics into three phases, used to read detection coverage across the attack lifecycle:
  • Initial access & discovery — Reconnaissance, Resource Development, Initial Access, Credential Access, Discovery.
  • Compromise & lateral movement — Persistence, Privilege Escalation, Defense Evasion, Lateral Movement.
  • Impact & exfiltration — Execution, Collection, Command and Control, Exfiltration, Impact.