<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-security-posture-scoring
description: >-
  Calculate and track endpoint security posture scores based on configuration compliance, patch levels, security agent health, and vulnerability exposure.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - posture-scoring
  - compliance
  - benchmarking
  - risk-scoring
  - endpoint-hardening
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Performing Endpoint Security Posture Scoring

## Overview

Endpoint security posture scoring quantifies the security health of individual
endpoints and the overall fleet. Scores aggregate multiple signals — patch
compliance, configuration hardening, security agent health, vulnerability
exposure, and encryption status — into actionable metrics.

## Prerequisites

| Requirement | Install |
|---|---|
| MDM platform | Intune, SCCM, or JAMF |
| Vulnerability scanner | Qualys, Tenable, or Rapid7 |
| SIEM / data platform | Score calculation and dashboarding |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Scoring Components

| Component | Weight | Data Source |
|---|---|---|
| Patch compliance | 25% | WSUS/Intune patch status |
| Configuration hardening | 25% | CIS benchmark compliance |
| Security agent health | 20% | EDR, AV status and version |
| Vulnerability exposure | 20% | CVSS scores from scanner |
| Encryption status | 10% | BitLocker/FileVault status |

### Score Calculation

Per-endpoint score (0-100):
```
score = (patch_pct x 0.25) + (config_pct x 0.25) +
        (agent_pct x 0.20) + (vuln_pct x 0.20) +
        (encrypt_pct x 0.10)
```
Fleet score = mean of all endpoint scores, weighted by criticality.

### Risk Tiers

| Score | Tier | Action |
|---|---|---|
| 90-100 | Excellent | Maintain current posture |
| 70-89 | Good | Address medium-priority gaps |
| 50-69 | Fair | Prioritize remediation |
| 0-49 | Poor | Immediate remediation required |

## Workflow

1. **Define scoring model** — select components, weights, and data sources
2. **Collect data feeds** — integrate MDM, scanner, and EDR data
3. **Calculate baseline scores** — compute initial posture for all endpoints
4. **Set target thresholds** — define minimum acceptable score per device tier
5. **Build dashboards** — visualize scores by OS, department, and location
6. **Automate remediation** — trigger actions for devices below threshold
7. **Track trends** — monitor score improvements over time

## Detection

```yaml
title: Endpoint Security Posture Scoring Detection
id: ca03219e-c329-4052-86f9-5e525e4ed770
status: experimental
description: Detects suspicious activity related to performing endpoint security posture scoring techniques in endpoint security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*endpoint*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.execution
falsepositives:
  - Endpoint management software performing routine maintenance tasks
```

## Verification

| Check | Method |
|---|---|
| Data feeds connected | MDM, scanner, EDR data flowing into scoring engine |
| Scores calculated | Per-endpoint and fleet-level scores computed |
| Thresholds set | Minimum scores defined for each device tier |
| Dashboard live | Posture score dashboard accessible to stakeholders |
| Trends tracked | Week-over-week score changes visible in reports |

## References

- [Microsoft Secure Score](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-53 CA-7](https://csrc.nist.gov/)
- [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document)
