Digital Trust Score Methodology: What the 300 to 850 Score Measures
Lalit Ahluwalia, Founder and CEO of DigitalXForce, wrote this page.
The Digital Trust Score is DigitalXForce’s composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. No sub-posture is scored from self-attestation. The score sits in one of five bands, from High Trust at 780 and above to Trust at Risk below 500, and it updates as the evidence changes.
Boards, regulators, customers and insurers follow the Digital Trust Score over time in the Digital Trust Portal, where it sits beside its seven sub-postures.
This page is the public methodology for the score. It explains what each sub-posture and each band means and where the evidence comes from. It also covers when the score moves and how a board should read it. The method that puts the seven sub-postures on the 300 to 850 scale is not published. The weighting behind the score is not published either. The glossary carries the short version in its Digital Trust Score methodology entry.
| The score at a glance | What the methodology says |
|---|---|
| Scale | The score runs from 300 to 850. |
| Sub-postures | Seven sub-postures are scored: security, compliance, audit, resilience, third-party, AI and risk. |
| Bands | Five bands run from Trust at Risk (300 to 499) up to High Trust (780 to 850). |
| Inputs | Validated control results feed the score. |
| Self-attestation | The score does not use it. |
| Test frequency | Each control has its own test frequency, set by how fast its evidence can change. |
| Traceability | Each input can be traced to the tool it came from, the control it belongs to and the date it was read. |
| Where it is read | Boards, regulators, customers and insurers read the score through the Digital Trust Portal. |
| Publication | DigitalXForce never publishes a customer’s score. |
| Unpublished parts | The weighting stays unpublished, and so does the method that puts the seven sub-postures on the scale. |
| Version | This is version 1.0 of the published methodology. |
What the Digital Trust Score measures
The Digital Trust Score is built from validated control results. Each result is stored with the evidence it read and the time it was read. Each sub-posture measures one area of trust and is scored on its own. The composite rolls the seven into one number a board can follow over time.
Enterprise TRiSCM™ is the platform behind the score. TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance.
Digital Trust translates connected assurance and risk evidence into an enterprise-level view for decision-makers. It is the last step of the model DigitalXForce follows. The company sums that model up in four verbs: monitoring detects, Continuous Control Assurance validates, Enterprise TRiSCM connects and Digital Trust translates. The Digital Trust Score is how DigitalXForce reports the enterprise-level view that Continuous Control Assurance feeds.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. In DigitalXForce, Continuous Control Monitoring is one capability within Continuous Control Assurance. The results that Continuous Control Assurance validates are the inputs to the Digital Trust Score.
Digital trust, as the World Economic Forum and ISACA describe it
The World Economic Forum published its report Earning Digital Trust in November 2022. The report defines digital trust as individuals’ expectation that digital technologies and the organizations behind them will protect every stakeholder’s interests and uphold society’s expectations and values. ISACA publishes the Digital Trust Ecosystem Framework and a self-assessment tool that measures an organization’s digital trust practices.
The seven sub-postures
Security posture
The security posture measures protection effectiveness. It looks at whether controls hold when tested, how exposed the organization is to attackers, how well identities are controlled and how quickly threats are detected and contained. Its evidence comes from the configuration checks of the ESRPM module and from Attack Surface Manager. Attack Surface Manager discovers and inventories assets across nine asset classes, IT and OT, without agents and through APIs.
Compliance posture
The compliance posture measures the maturity of risk assessment and the state of certifications. It also covers the governance of policies and plans, and how ready the evidence is. Evidence for it comes from the AI-Powered Risk Management and Automated GRC module and the AI-Powered Policy and Compliance Management module. The GRC module maps each control once to 50+ compliance frameworks through the X-Connect and E-Connect adapters. Privacy controls count toward the compliance sub-posture for the privacy frameworks an organization maps.
Audit posture
The audit posture measures readiness and defensibility. It looks at SOX and ITGC maturity, the lineage of each piece of evidence, how much of the audit runs automatically and how findings move to remediation. A-Assess, the audit assessment in the AI-Powered Risk Management and Automated GRC module, supplies its evidence.
Resilience posture
The resilience posture measures the ability to respond and recover. It weighs how far the business impact analysis can be trusted, whether continuity and recovery plans would work, how ready the organization is for a crisis and how recently each plan was tested. Its evidence comes from Business Continuity and Operational Resilience (X-BCOR), where continuity and recovery plans are tied to live control coverage.
Third-party posture
The third-party posture measures how vendors are governed and whether every critical vendor is covered. It also looks at how fresh each assessment is and whether contractual security terms are enforced. The AI-Powered Third-Party Risk Management (TPRM) module and External Risk View hold its evidence.
AI posture
The AI posture measures the completeness of the AI inventory and the risk of each model and use case. It also measures the sensitive data each one can reach and whether a person oversees it. Its evidence sits in the AI TRiSCM and AI Risk Governance module.
Risk posture
The risk posture measures residual risk, how concentrated risk is, how quickly risks grow and how long they stay open, and whether treatments work. It draws on the risk register in the AI-Powered Enterprise Risk Management (ERM) module and on KPI and KRI Management. Enterprise risk management (ERM) is the organization-wide practice of identifying, assessing, treating and monitoring the risks that affect an organization’s objectives, in one view instead of in separate silos.
The five trust bands and what each one means
Every score falls in one of five bands. The band tells a board how much attention the posture needs, and the seven sub-postures show where that attention should go.
| Band | Score range | What the band means |
|---|---|---|
| High Trust | 780 to 850 | The organization is fully governed, its evidence is ready for a regulator, and its posture can carry critical and systemic workloads. |
| Trusted, Watchful | 700 to 779 | The posture is strong, and the remaining gaps are targeted and under active remediation. |
| Conditional Trust | 620 to 699 | The posture is acceptable, but exposure is elevated and a remediation roadmap is required. |
| Low Trust | 500 to 619 | Maturity is inconsistent and the risk is material, so intervention at board level is warranted. |
| Trust at Risk | 300 to 499 | The organization carries material business risk, and restricted onboarding, expanded oversight or a remediation freeze is required. |
A score of 650 sits in Conditional Trust, so the organization needs a remediation roadmap. The sub-postures show where that roadmap starts, and X-ROC shows what is still outstanding.
The evidence behind the Digital Trust Score
DigitalXForce reads its evidence through X-Connect adapters for security tools and E-Connect adapters for enterprise systems. Enterprise Security Risk and Posture Management (ESRPM) is the DigitalXForce module that runs configuration checks, operational insights and deployment benchmarking across IAM, SIEM, cloud, OT and IoT, SecOps and enterprise systems through 250+ technology integrations. ESRPM also reads AWS, Azure and GCP account configurations directly, and it maps findings from CSPM tools to the controls they affect. The integrations page lists the connected tools.
The platform is built on a Cybersecurity Mesh Architecture. Each of the 15 modules reads and writes the same control library, the same evidence store and the same data layer. Each input can be traced to the tool it came from, the control it belongs to and the date it was read.
On the compliance dashboards, each control shows the age of the evidence behind it. An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. Evidence age puts that gap on the dashboard, so old evidence is visible instead of being counted as a pass.
AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. An analyst reviews the output of both engines before anyone relies on it, and every conclusion links back to the evidence it used.
When the Digital Trust Score moves
Each control has its own test frequency, set by how fast its evidence can change. A security configuration can change many times a day, while a signed policy acknowledgment may change once a month or less. The score moves when a control result changes, not on a reporting date.
A control tested once counts toward every framework it maps to, and the same result updates the compliance view, X-ROC and the Digital Trust Score.
Events raise or lower the Digital Trust Score as they open and close. X-ROC shows which events raised the score, which lowered it and what is still outstanding. A board that asks why the score moved last week gets an answer tied to a control and a date.
What happens when a control fails
When a control fails, DigitalXForce opens a finding. Since all 15 modules share one data layer, one failed control result reaches the compliance view, the posture view and the risk register at the same time.
X-ROC, the XForce Risk Operations Center, is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported. Each failed control, posture change or vendor event arrives in X-ROC as an alert with its evidence attached. Triage ranks those alerts by quantified business impact, using cyber risk quantification, and not by a severity label alone. Cyber risk quantification (CRQ) quantifies a cyber risk in dollars, giving the financial loss the organization would face if the risk materializes.
X-ROC escalates each alert and tracks remediation to closure. Remediation tickets can go to ServiceNow or Jira when the client wants that. X-ROC never changes a client’s systems on its own, so the team that owns the system makes the fix.
When the fix is marked done, the control is tested again, and the finding closes only when the retest passes. By the end of that cycle, the Digital Trust Score has moved and XForce GPT has written the board report.
How third parties and AI systems count
Third-party risk management (TPRM) is the discipline of identifying, assessing, monitoring and controlling the risks an organization takes on through its suppliers, vendors and other outside parties. The third-party sub-posture measures how the organization governs its vendors, including whether every critical vendor is covered and how fresh each assessment is.
DigitalXForce places each supplier in one of three tiers: Tier 1 Critical, Tier 2 High or Tier 3 Commodity. Each vendor also gets its own score, built from its questionnaire answers, its evidence and external signals. The TPRM module page describes how vendors are scored, and this methodology describes the organization’s own Digital Trust Score.
External Risk View watches suppliers from the outside, and it needs no agent, no questionnaire and no cooperation from the supplier. It maps fourth-party and nth-party dependencies. When a supplier reports a breach, AI JedAI maps it to the services and data that depend on that supplier.
AI governance is the set of policies, roles, controls and evidence an organization uses to decide which AI systems it runs, how they may be used and whether their controls keep working. The AI TRiSCM and AI Risk Governance module finds AI assets across cloud, code, pipelines, containers, model endpoints and RAG stores. It assesses LLMs, copilots, agents and models. It maps them to the NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS. Across the AI lifecycle, the module adds production approval, policy gates, exception management and remediation tracking.
How the Digital Trust Score differs from a security rating
The Digital Trust Score is not a security rating, and the difference starts with the data each one reads.
| Question | An outside-in security rating | The Digital Trust Score |
|---|---|---|
| Where the data comes from | A rating is computed from outside, from data that can be observed on the internet. | The score is computed from the organization’s own control evidence inside the platform. |
| Whose participation it needs | A rating can score a company without its participation. | The score needs the organization to connect its own systems through the 250+ technology integrations. |
| What it covers | A rating covers what is externally observable. | The score also covers internal controls such as audit evidence, resilience testing and AI governance, which are not externally observable. |
DigitalXForce reads the outside view as well. External Risk View is the outside-in engine of the platform. It monitors exposed services, misconfigurations, vulnerability exposure, dark web and breach intelligence and lookalike domains. Cyber ratings are one of its outside signals too.
How to read a Digital Trust Score
The Digital Trust Score is a DigitalXForce score, not an industry standard. It is only as current and as complete as the validated evidence beneath it, and it reports what the Enterprise TRiSCM platform finds without being the platform itself.
Read the score with its seven sub-postures beside it. Two organizations can sit in the same band for different reasons, and the sub-postures show which reason applies to each.
Compliance is a separate question. A strong score does not replace an audit opinion or a certification. Auditors work in the DigitalXForce platform and DigitalXForce gets clients ready for their audits, while the attestation stays with the auditor. For SOC 2, DigitalXForce prepares organizations and reviews SOC 2 reports with automation and AI, and an independent CPA firm issues the report.
The Digital Trust Score is also not a dollar figure or a prediction of a breach. Expected financial impact comes from cyber risk quantification, which the platform produces as a separate output.
Who sees the score, and where the data stays
The Digital Trust Portal is the external-facing part of the platform. Boards, regulators and customers read shareable posture dashboards there, including the Digital Trust Score and its seven sub-postures. DigitalXForce never publishes a customer’s score.
The full DigitalXForce platform runs in the client’s own hosting, so the client keeps full control of its data, which is the model DigitalXForce prefers. DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality, for any organization that prefers cloud hosting. Both include the Digital Trust Score.
Questions to ask about any digital trust score
These questions work on any digital trust score, whoever produces it.
- Ask what the score is built from, and whether any part of it comes from self-attestation.
- Ask to see one control behind the score, the evidence it used and when that evidence was read.
- Find out how old the evidence behind each sub-posture is, and where that age is shown.
- Ask what set each control’s test frequency.
- Ask which event moved the score last week, and whether that event traces to a tool, a control and a date.
- Ask what happens to a finding after the fix is marked done, and what has to be true before it closes.
- Check who can see the score, and whether the vendor ever publishes it.
DigitalXForce’s answer to each one is in the sections above.
Who publishes this methodology
DigitalXForce is the AI-native Enterprise Trust, Risk, Security and Compliance Management (TRiSCM) platform unifying automated GRC and security posture management. DigitalXForce serves mid-size and large organizations.
IDC named DigitalXForce a Leader in the IDC MarketScape: Worldwide Governance, Risk, and Compliance Software Vendor Assessment, 2025, document US53615325, published in June 2025. In September 2026, IDC named DigitalXForce a Leader again, in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment, document US53007725. The DigitalXForce IDC research page lists both documents with their numbers and dates.
Frequently asked questions
What is the Digital Trust Score?
The Digital Trust Score is DigitalXForce’s composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. No sub-posture is scored from self-attestation. The score sits in one of five bands, from High Trust at 780 and above to Trust at Risk below 500, and it updates as the evidence changes.
How is the Digital Trust Score calculated?
The Digital Trust Score is built from validated control results, and each result is stored with the evidence it read and the time it was read. Each of the seven sub-postures is scored on its own, and the composite rolls them into one number from 300 to 850. The method that puts the seven sub-postures on the 300 to 850 scale is not published, and the weighting behind the score is not published either.
What does a Digital Trust Score of 650 mean?
A Digital Trust Score of 650 sits in the Conditional Trust band, which runs from 620 to 699. In that band the posture is acceptable, but exposure is elevated and a remediation roadmap is required. The seven sub-postures show where the roadmap starts, and X-ROC, the XForce Risk Operations Center, shows which events raised or lowered the score.
How often does the Digital Trust Score change?
Each control has its own test frequency, set by how fast its evidence can change. The Digital Trust Score changes when a control result changes, and it does not wait for a reporting date. X-ROC shows which events raised or lowered it.
Is any part of the Digital Trust Score self-reported?
No sub-posture is scored from self-attestation. Validated control results are the inputs, and DigitalXForce keeps the source tool, the control and the date for every one of them.
Is the Digital Trust Score a security rating?
The Digital Trust Score is not a security rating. Security ratings are computed from outside, from data that can be observed on the internet, and they can rate a company without its participation. The Digital Trust Score is computed from the organization’s own control evidence inside the platform. It also covers internal controls such as audit evidence, resilience testing and AI governance, which are not externally observable.
Does a high Digital Trust Score mean an organization is compliant?
A high Digital Trust Score does not make an organization compliant with any framework. Auditors still attest, and the compliance and audit sub-postures show how ready the evidence is when they do.
Who can see an organization’s Digital Trust Score?
Boards, regulators, customers and insurers read the Digital Trust Score through the Digital Trust Portal, the external-facing part of the platform. DigitalXForce never publishes a customer’s score.
Sources
Every DigitalXForce statement on this page comes from DigitalXForce product material and from these pages.
- The glossary entry for the Digital Trust Score and its methodology section give the definition, the bands and the two unpublished parts of the method.
- The DigitalXForce FAQ gives the seven sub-posture definitions and the difference from a security rating.
- The Digital Trust Portal product page describes the shareable posture dashboards that boards, regulators and customers read.
- The X-ROC product page describes how events raise or lower the score and how a finding closes.
- The Continuous Control Assurance page and the Continuous Control Monitoring page define the two disciplines behind the evidence.
- The Cybersecurity Mesh Architecture page describes the shared control library, evidence store and data layer.
This page also cites these outside sources.
- The World Economic Forum published Earning Digital Trust: Decision-Making for Trustworthy Technologies in November 2022.
- ISACA describes its Digital Trust Ecosystem Framework and its self-assessment tool on its Digital Trust page.
- IDC’s document pages for US53615325 and US53007725 give the titles and publication dates of the two IDC MarketScape assessments.
- The AI framework links go to NIST, OWASP and MITRE.
DigitalXForce last checked its own pages listed above on October 25, 2026, and the outside sources on September 29, 2026.
See the score against your own evidence.
A 30 minute walkthrough on your own frameworks and your own integrations is the quickest way to test this method against your program. The DigitalXForce team answers every demo request within 1 business day.
