What is a process trust score?
In NetGlobe, a process trust score is a 0–100 rating assigned to every process that has network connections — a quick, human-readable summary of how trustworthy that process looks, based on several observable signals, with the specific reasons shown so you can judge for yourself.
The short version
A trust score is a triage signal, not a verdict. It rolls things NetGlobe can observe — whether the executable is code-signed, where it lives on disk, how old the file is, and what launched it — into a single 0–100 number, and then shows you the reasons behind that number.
It exists to help you decide what to look at first. A low score is a prompt to investigate, not proof of malware — and NetGlobe is not antivirus: it doesn't block, remove, or definitively classify anything.
What a process trust score is.
When a process on your Mac or PC opens a network connection, NetGlobe rates it on a scale from 0 to 100. The score is a compact way of answering a practical question — does this thing making an outbound connection look like something I can trust? — without you having to inspect every executable by hand.
The important part is that the number never stands alone. Alongside the score, NetGlobe lists the signals that produced it, so you're never asked to trust a black-box rating. You see a score and its reasoning together, and that's what lets you make your own call.
What signals feed the score.
These are examples of the factors NetGlobe weighs — not an exhaustive or fixed formula. Any one of them can be innocent on its own; the score reflects how they combine.
Code-signing status
Is the executable signed by a recognized publisher, or is it unsigned? A valid signature from a known developer is reassuring; an unsigned binary making network calls is more worth a look.
File location
Where the file lives matters. A binary running from a legitimate system path reads very differently from one launched out of a temp, cache, or downloads folder.
File age
How long the file has existed. A binary that appeared on disk minutes ago is more suspect than one that has been sitting in place, unchanged, for months.
Parent-process attribution
What launched it. A network process spawned by a document, a script, or an office macro is a classic flag — normal applications rarely start that way.
Why the score is useful.
Raw connection logs are noisy. A low trust score on a process that's actively making outbound connections is a fast, human-readable prompt to look closer — and because NetGlobe shows you why it scored low, you're reacting to concrete reasons rather than a bare verdict.
That turns a vague "something feels off" into something specific: "this unsigned process, launched by a script out of a temp folder, is talking to a server abroad." Same connection, but now it's far easier to decide whether it deserves your attention.
What a trust score is not.
This is the part worth reading twice. A trust score is a heuristic — a triage aid, not proof.
A score is a starting point, not a conclusion
A low score doesn't mean malware. Plenty of legitimate software is unsigned, freshly installed, or lives in an unusual place — indie tools, dev builds, and portable apps all trip these signals routinely.
A high score doesn't guarantee safety either. Sophisticated malware can be code-signed, can live in a normal path, and can masquerade as a trusted process.
So treat the score as a starting point for investigation. NetGlobe is a network-visibility and diagnostics tool; it does not block, remove, or definitively classify anything, and it is not a substitute for antivirus.
Where you see it in NetGlobe.
The trust score lives in the Endpoint Focus panel. Click a connection on the live map or 3D globe and NetGlobe pivots to that endpoint, showing the process behind it, its 0–100 score, and the contributing reasons listed out — code-signing status, file location and age, and the parent process — alongside the network owner via WHOIS/RDAP, the TLS certificate, and any threat-intel matches. The score is one lens among several, not the whole picture.
Related terms
Process trust score — FAQ
What is a process trust score?
It's a 0–100 rating NetGlobe assigns to each process that has network connections, summarizing how trustworthy the process looks based on observable signals such as code-signing status, file location, file age, and what launched it. The score is always shown with the reasons behind it, so you can judge for yourself rather than trust a bare number.
What makes a process's trust score low?
Factors that tend to lower a score include an unsigned executable, a file running from a temp or downloads folder, a binary that only appeared on disk recently, or an unusual parent process — for example a document, script, or macro spawning a network connection. Any one of these can be perfectly innocent; the score reflects how they combine, and NetGlobe lists which reasons applied.
Does a low trust score mean malware?
No. A low score is a signal to investigate, not proof of malware. Legitimate software is sometimes unsigned, newly installed, or stored in an unusual location, so a low score simply means the process is worth a closer look. Treat it as a starting point, not a verdict — and remember that sophisticated malware can be signed and score high, so a high score isn't a guarantee of safety either.
Is NetGlobe antivirus?
No. NetGlobe is real-time network intelligence and diagnostics, not antivirus. The trust score is a heuristic that helps you spot connections worth inspecting; NetGlobe does not detect, block, or remove malware. Keep a reputable antivirus for detection and removal, and use NetGlobe to see and understand what your machine is doing on the network.
Where do I see the trust score?
In the Endpoint Focus panel. Click any connection on NetGlobe's live map or 3D globe and it shows the process behind it, its 0–100 trust score, and the contributing reasons — code-signing status, file location and age, and the parent process — next to the endpoint's network owner (WHOIS/RDAP), TLS certificate, and any threat-intel matches.
A process trust score is a heuristic triage signal, not a definitive security assessment. NetGlobe is a network-visibility and diagnostics tool — it does not detect, block, or remove malware, and it is not antivirus or a substitute for dedicated security software. Signals and their weighting are described here as examples and may change as NetGlobe evolves.
See the score — and the reasons behind it.
Every outbound connection, geolocated in real time, with a trust score and the evidence for it on the process behind each one. A one-time $18.99 on the Microsoft Store for Windows, or a direct download for Mac.
No account. Runs entirely on your device. See the full feature list or the FAQ.