Scoring what’s already blocked, not just what got through
Most of the gap-analysis material in this report focuses on permitted traffic that slipped past enforcement. This chart looks the other direction: of everything Demo Org’s firewall already denied, how much of it corresponds to sources OneFirewall independently scores as Critical or High. A firewall’s own deny log doesn’t carry that distinction internally — a block is a block, regardless of whether the source has a Crime Score of 190 or 950. Re-scoring the denied traffic recovers that detail.Why this number is reassuring rather than alarming
Unlike the permitted-and-malicious figures elsewhere in this report, 526 and 257 aren’t a gap — they’re confirmation. This is traffic the existing rule set was already right to block, now with a severity figure attached to it. Like the small “contributed value” slice in the enforcement-split chart, it confirms that a meaningful share of current blocking activity lines up with high-confidence scoring, rather than blind or overly broad rules.Proof of Value engagements re-score a client’s own denied traffic in the same way. Start a Proof of Value.