ThreatReadyHome / Scoring
A score you can read, question and challenge.
Every Lab answer is scored on five anchored dimensions, through three passes, against a rubric we publish — with a human appeal if you disagree.
The scoring pipeline
- Input
Your answer
Scored against the question's rubric anchors and dimension weights.
- Pass 1
Evaluator
Scores each dimension against the anchored rubric, citing evidence from the answer.
- Pass 2
Challenger
Reviews adversarially: technical errors, invented techniques or CVEs, inflated scores.
- Pass 3
Reconciler
Resolves disagreements, applies weighting, writes the model answer.
- Output
Score + confidence
Final score with a High, Medium or Low confidence flag.
Answers are evaluated with Anthropic's Claude API; Anthropic does not train models on API inputs. See the Privacy Policy.
What gets scored, 1–10 each.
Threat Identification
Attack vectors, techniques and attacker behaviour — precise ATT&CK mapping at top scores.
Containment & Response
Limits blast radius while preserving evidence, aware of obligations such as CERT-In, GDPR and DPDPA.
Architecture & Blast Radius
How components connect, what an attacker can reach, where segmentation helps.
Communication Quality
Clear, structured and right for the audience — board briefing to technical deep-dive.
Framework Application
ATT&CK, NIST, CIS and ISO 27001 applied correctly — and knowing when they don't apply.
Weighted per question
Each question category weights the dimensions differently. See the weighting matrix.
Every score maps to a plain-language band.
Bands are visible from day one, before there is enough cohort data for percentiles.
| Confidence | When it applies |
|---|---|
| High | Pass 1 and Pass 2 agree within one point on all five dimensions; no critical errors. |
| Medium | One or two dimensions disagree by 2 points; no critical errors. |
| Low | A disagreement of 3+ points or a critical error. Flagged "Review recommended" and queued for internal review. |
Challenge any score within 14 days.
Email your session ID and what you believe was mis-scored. A security engineer reviews the full transcript and rubric application within 7 business days.
Reasoning, not polish.
Not grammar beyond clarity, not typing speed, not accent in voice mode, not tool or vendor preference, and not agreement with our model answer.
Read the full rubric.
Score anchors, weighting, confidence and worked examples.