SecQua is a tool that quantifies the security of a given Information System, using a novel security metric. It tries to provide a deterministic, unbiased, objective, and efficient measurement. The approach is vulnerability driven and uses the National Vulnerability Database. A security metric must answer questions such as "How secure am I?", "Am I better compared to my last checkpoint/year?", "Am I spending the right amount of money for security?", "How do I compare to my peers?", and "What risk transfer options do I have?". SecQua can state that a system is now 60.2% secure, when last month it was 46.5%. Moreover, it tries to depict how vulnerability patterns expose the information system over time.
