I just started using Orca at my new job. The overall security posture score on the dashboard is a single number, but I'm not clear on what exactly it's measuring.
I set up a test VM with some intentional misconfigurations (open ports, default creds). Orca flagged the issues correctly, but the posture score only moved from 82 to 79. That seems like a small change for critical findings. Has anyone dug into how this score is actually calculated? Is it weighted by asset importance or something?
```json
// Example of a finding Orca reported
{
"severity": "high",
"category": "insecure_configuration",
"asset": "test-vm-01",
"description": "SSH server allows password authentication"
}
```
If the score is this opaque, can we trust it for reporting to management? I'd love to hear how others are using it.