Weighted Compliance: Why Your Security Score Is Lying to You

The 85% Compliance Myth

You open your CSPM dashboard. It says 85% compliant. Your CISO asks: "Is that good?"

The honest answer? You have no idea.

Traditional compliance scores are calculated by dividing passing checks by total checks. Simple math, terrible metric. Here's why.

The Resource Count Trap

Imagine two controls:

• Control A: "Root account should have MFA" — affects 1 resource (the root account)
• Control B: "S3 buckets should have versioning" — affects 500 resources (every bucket)

If Control A fails and Control B passes, your score shows 500/501 = 99.8% compliant. Looks great, right?

But Control A — the root account without MFA — is arguably the most critical security issue in your entire AWS environment. It's hidden behind a wall of passing S3 checks.

How Weighted Compliance Works

Instead of counting raw checks, Vigimati weights each control by its criticality:

One Control, One Vote

Each control gets exactly one vote in your compliance score. Whether it applies to 1 resource or 10,000, its impact on the score is proportional to its importance, not its resource count.

Criticality-Based Weighting

Controls are weighted by their security impact:

• Critical controls (root MFA, public access, encryption at rest) carry heavy weight
• Important controls (logging, monitoring, backups) carry standard weight
• Advisory controls (naming conventions, tagging) carry minimal weight

Fair Scoring

The result is a score that reflects what actually matters. If your most critical controls are failing, your score drops — even if thousands of lower-priority checks are passing.

Traditional vs. Weighted: A Real Example

Metric	Traditional	Weighted
Controls passing	45/50	45/50
Traditional score	90%	—
Weighted score	—	72%
Why?	Counts equally	3 failing controls are CRITICAL

In this example, the traditional score says "you're doing great." The weighted score says "you have serious gaps in your critical controls." Which would you rather know?

The Score That Actually Helps

A weighted compliance score gives you something traditional scores never could: actionable direction. When your score drops, you know it's because something important failed. When it rises, you know it's because you fixed what mattered.

No more chasing easy wins to inflate a meaningless number. Focus on what actually protects your organization.

See Your Real Score

Try Vigimati free. Connect your AWS account and compare your traditional compliance score with your weighted score. The difference might surprise you.