QR Score Overview
The Quantified Resilience Score (QR Score) is a composite 0–100 metric that answers a single question:
How well can this organization’s infrastructure withstand and recover from disruptions?
How it works
Section titled “How it works”The score is calculated daily by analyzing the organization’s live infrastructure graph: the network of devices, connections, and dependencies that make up their IT/OT environment.
Infrastructure Graph → Analysis Engines → Four Pillars → Weighted Score (0-100)Data sources
Section titled “Data sources”The score is derived from real infrastructure data, not self-reported questionnaires:
- Network topology: how devices are connected and what depends on what
- Device health telemetry: current operational status and risk indicators
- Probabilistic simulations: failure modeling across tens of thousands of scenarios
- Structural analysis: identifying single points of failure, redundancy, and architectural weaknesses
Calculation frequency
Section titled “Calculation frequency”Scores are calculated daily and persisted with full audit history. Each calculation captures a point-in-time snapshot that can be compared against previous scores to track resilience trajectory.
Methodology
Section titled “Methodology”The QR Score was built to actuarial standards: measurable inputs, reproducible calculations, and full auditability to the day each score was produced. Each assessment runs 10,000 to 100,000 failure simulations against a digital twin of the organization’s infrastructure, modeling how disruptions cascade through real devices, connections, and dependencies. Scores are calculated daily and persisted with complete history, so any score can be verified for any date, and any change in the score can be traced to a change in the underlying environment.
That means an underwriter can price against it, a regulator can accept it as point-in-time evidence, and a diligence team can compare it across targets, all without anyone taking the methodology on faith.
One score, every audience
Section titled “One score, every audience”The QR Score provides a quantified, evidence-based resilience metric that every stakeholder reads the same way:
- Cyber underwriters: an objective, trendable risk signal for pricing and renewal decisions, derived from live infrastructure data rather than questionnaires
- Regulators and auditors: continuous, date-stamped evidence of operational resilience posture, with full score history for any point in time
- M&A and third-party risk management (TPRM) diligence: a comparable resilience baseline for evaluating targets and third parties
- Boards and public trust pages: a single number that translates technical posture into business language
Whatever the audience, the same properties hold:
- Objective: derived from live infrastructure data, not self-attestation
- Trendable: daily history shows whether resilience is improving or degrading
- Decomposable: pillar breakdown identifies specific areas of strength and weakness
- Transparent: the scoring methodology is fully documented in these pages
For enterprises
Section titled “For enterprises”The QR Score gives security leaders a continuous, quantified view of their infrastructure resilience:
- Measurable: a single score that tracks resilience over time, replacing subjective assessments
- Actionable: prioritized recommendations identify where to invest for maximum impact
- Board-ready: clear grades and trend data translate technical posture into business language
- Benchmarkable: track progress against your own historical baseline as you remediate