Well-Architected scorecard
Your organisation scored against the Well-Architected Framework, from 4 ungated AWS sources plus 117 rules of our own. Every number decomposes into the rows underneath it.
The category leader describes its score as "a proprietary algorithm honed through hundreds of engagements," calculated from three public AWS services. Read closely, that says the inputs are public and the arithmetic is the secret. We publish the arithmetic instead. How a Security Hub FAILED control, a Service Quotas headroom breach and a Compute Optimizer finding become one number per pillar is documented, and you can reproduce it.
An 84% that covers a third of a pillar is a worse number than a 71% that covers all of it, and a score shown without its denominator hides exactly that. Coverage is reported per pillar, not only overall — because the overall figure is where a shallow pillar disappears.
The framework is a hierarchy: pillar, question, best practice. Scoring raw checks would let a question with thirty automatable checks outweigh one with three, and the score would move when we wrote more rules rather than when your posture changed. Questions are the unweighted mean over their best practices, pillars the unweighted mean over their questions.
A severity-weighted composite is a judgement call, and the first customer to dispute the weighting disputes the product. Everything is an unweighted mean, all the way up. Severity still drives what to fix first — it just does not secretly move the score.