The final score is kind of a die roll, but I appreciate having at least a common vocabulary to discuss these. It also means that a given vendor can’t completely downplay they score. “Sure, it’s network accessible without authentication using wget, but we consider that a low.”