> ## Documentation Index > Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt > Use this file to discover all available pages before exploring further. # 526 Critical, Denied > Breaking the traffic a firewall already blocked down by severity, to see what share of it was high-confidence to begin with This is the denied side of Demo Org's traffic, re-scored by severity: **526** Critical events and **257** High events, sitting alongside smaller Medium and Low segments, all inside traffic the firewall had already blocked before OneFirewall was introduced. *** ## Scoring what's already blocked, not just what got through Most of the gap-analysis material in this report focuses on permitted traffic that slipped past enforcement. This chart looks the other direction: of everything Demo Org's firewall already denied, how much of it corresponds to sources OneFirewall independently scores as Critical or High. A firewall's own deny log doesn't carry that distinction internally — a block is a block, regardless of whether the source has a Crime Score of 190 or 950. Re-scoring the denied traffic recovers that detail. ## Why this number is reassuring rather than alarming Unlike the permitted-and-malicious figures elsewhere in this report, 526 and 257 aren't a gap — they're confirmation. This is traffic the existing rule set was already right to block, now with a severity figure attached to it. Like the small "contributed value" slice in the enforcement-split chart, it confirms that a meaningful share of current blocking activity lines up with high-confidence scoring, rather than blind or overly broad rules. *** Proof of Value engagements re-score a client's own denied traffic in the same way. [Start a Proof of Value](https://onefirewall.com/proof-of-value).