Coverage scoring
Scoring uses schema-validated, canonical evidence from completed runs. Model and judge outputs are not assumed deterministic; ambiguous or incomplete evidence remains N/A.
Coverage scoring answers one question: which categories of the OWASP LLM Top 10 hold conclusive evidence for this tenant, and in which state? Every other reading — trend, comparison, grade — builds on that per-category foundation.
The score is deliberately conservative. Where evidence is ambiguous, incomplete, or merely historical, the affected value is N/A rather than a plausible-looking number.
Key points
- Each finding retains its numeric confidence, evidence references, and the run lineage used for scoring.
- Only a completed run whose canonical lineage can be recomputed contributes a conclusive score.
- Current LLM coverage weights tested categories as 1, remediated as 0.7, and open or untested as 0.
- Wording robustness is a separate paired-probe analysis and remains N/A unless the same scope was actually measured with literal and paraphrased inputs.
Score states
- Tested: conclusive evidence exercised the category without an open finding.
- Remediated: conclusive evidence records prior findings that are now closed.
- Open: at least one decision-grade finding remains open; untested means no conclusive evidence exercised the category.
States move only on conclusive evidence. A remediated category, for example, requires prior findings recorded as closed: a clean single run after a fix is suggestive, but the state machine tracks the lineage, not the impression.
Reading the score
- Read the assessment status and evidence coverage before interpreting any aggregate.
- Do not infer wording robustness from a single run or from a historical research snapshot.
- Rate limits, authorization, and other structural controls still require conclusive evidence from the tenant's tested scope.
When presenting scores externally, quote the state and the evidence window together. A category marked tested under a narrow scope says less than the number suggests, and this page exists so that distinction is never lost.
Related resources