Cisco Secure Access Help

Experience Score

Updated: August 24, 2026

Want to summarize with AI?

Experience Score is a real-time measure of an endpoint’s overall health and user experience.

Experience Score is a real-time measure of an endpoint’s overall health and user experience. It is calculated by averaging multiple segment scores, each representing a different aspect of the endpoint’s performance and connectivity. Based on the final score, the endpoint is shown as Healthy, Unhealthy, or Undetermined.

Based on the final averaged score, the endpoint’s status is categorized as:

Healthy: The endpoint is performing well across all segments.
Unhealthy: One or more segments indicate poor performance or connectivity.
Undetermined: Insufficient data or inconclusive results to determine health.

Each segment score is calculated independently, and the overall Experience Score is the average of all segment scores. The experience score aggregates the following segment scores:

Agent: Reflects the device’s CPU and memory usage.
Connections: Displays the health status of network connections, including wired and wireless. Connection health is based on metrics such as link speed and signal quality, helping identify issues with the endpoint’s network connectivity.
Gateways: Shows the health of gateways (local routers or network gateways) that endpoints connect through. Gateway health is assessed using metrics like packet loss, latency, and jitter measured from devices connected to the gateway, indicating the quality of the local network segment.
VPNs: Reflects the health of VPN connections used by endpoints. VPN health scores are derived from metrics such as VPN ping loss, latency, jitter, and error flags, aggregated across devices connected to the VPN, providing insight into VPN performance and reliability.
Proxies: This indicates the health of proxy servers used by endpoints. Proxy health is measured primarily using HTTP connect times and proxy-specific error codes obtained from end-to-end HTTP measurements. Additionally, latency, jitter, and loss metrics are derived from both local network (ping) and end-to-end network measurements. These combined metrics help detect proxy-related issues by reflecting the responsiveness and reliability of the proxy servers.
Applications: Displays the health status of monitored applications based on scheduled tests and performance metrics, allowing identification of application-level degradation affecting user experience.

Since the experience score is an average, it is possible for some segments to be impacted while the overall score remains Healthy. This means:

Even if certain segments show issues, the overall experience score may still indicate a healthy status.
This occurs because strong scores in other segments can offset unhealthy segments when averaged.

Experience Insights assigns a summary Experience Score to each endpoint in the table and on the endpoint performance map. Navigate to Experience Insights > Overview page to see the Experience score map.

Segment Thresholds: Agent, Connection, Gateway, Proxy, VPN, and Application

Table 1. Experience Score
Quality	Score Range
Unhealthy	0 to 50
Healthy	51 to 100

Table 2. Agent Score
	Healthy	Unhealthy
CPU usage	≤ 70%	>70%
Memory usage	≤ 90%	> 90%

Table 3. Application Score
	Healthy	Unhealthy
HTTP Test
Experienced Time To First Byte (TTFB)	≤ 3000ms	> 3000ms

Network Test (PING)
Latency (ms)	≤ 250ms	> 250ms
Jitter (ms)	≤ 75ms	> 75ms
Loss (%)	≤ 10%	> 10%

Dynamic Test (AST)
Latency (ms)	≤ 300ms	> 300ms
Jitter (ms)	≤ 50ms	> 50ms
Loss (%)	≤ 10%	> 10%

Table 4. VPN Score
	Healthy	Unhealthy
VPN Loss	< 10%	> 10%
VPN Latency	≤100ms	>100ms
VPN Jitter	≤30ms	> 30ms

Table 5. Gateway Score
	Healthy	Unhealthy
Gateway Loss	<10%	>10%
Gateway Latency	<30ms	>30ms
Gateway Jitter	<25ms	>25ms

Table 6. Proxy Score
	Healthy	Unhealthy
Proxy Latency	<150ms	>150ms
Proxy Jitter	<75ms	>75ms
Proxy Loss	<10%	>10%

Table 7. Connection Score
	Metric	Healthy	Unhealthy
Wired Connection	Link Speed	>10 Mbps (typical good speeds)	<10 Mbps
Wireless Connection	Signal Quality (RSSI)	> 50 (strong signal quality)	<50

An endpoint with a health status of Undetermined indicates one of the following scenarios in which Experience Insights has not received test data from the endpoint agent.

The endpoint is offline.
The endpoint agent is disabled.
The endpoint agent is online, but the test was interrupted by an error reported in the Error column.
Only for Windows: The endpoint has an Npcap error, shown next to the device name in the endpoint table.

ThousandEyes Agent Version

Use the endpoint table to monitor endpoints that have not updated to the latest ThousandEyes agent version. For more information about features and fixes delivered by each agent version, see the ThousandEyes Changelog for Endpoint Agent Client release notes.

Endpoint health metrics reported by an out-of-date agent may not match metrics reported by up-to-date agents.
The ThousandEyes endpoint agent checks for updates every four hours. If an update is available, it will download in the background and attempt installation later. Updates occur only if a new version is available, typically once a month, but can be more frequent if patches are needed. If an update fails, the ThousandEyes agent version field in the Experience Insights endpoint table shows a warning icon with a tooltip.
There is no method for retrying a failed update. However, you can download and reinstall Cisco Secure Client with the ThousandEyes Endpoint Agent Module to trigger an update to the endpoint agent. For detailed instructions, see Download Cisco Secure Client. It is not necessary to uninstall Secure Client before running the Secure Client Setup.exe wizard. Reinstalling without uninstalling means that you do not need to run the registration script to associate the endpoint with your ThousandEyes account.
For more information, see Endpoint Agent FAQ.

The ThousandEyes endpoint agent leverages the Npcap driver library to collect metrics on Windows devices. A warning icon in the endpoint table Device name field indicates a Windows device with an Npcap version that is unsupported by ThousandEyes. ThousandEyes will not collect metrics from Windows devices with unsupported versions.

To enable unsupported versions of Npcap, navigate to Advanced agent settings in ThousandEyes. For more information, see Npcap Driver Upgrade Management in ThousandEyes documentation.

ThousandEyes Metrics

Experience Insights defines metrics as follows. For more information, see ThousandEyes Metrics: What Do Your Results Mean?

Latency: The average of the round-trip packet time. Round-trip packet time is the time from which a packet is sent by the agent to the time the agent receives a reply.
Jitter: The mean deviation of latency. The mean deviation represents how far, on average, all measurements are from the mean of the data.
Loss: End-to-end packet loss. The percentage of packets lost is calculated by subtracting the number of reply packets the agent receives from the target (responses) from the number of packets sent by the agent, then dividing by the number of packets sent, then multiplying by 100.
Response time: The time elapsed from the beginning of the request (before the DNS request) until the client receives the first byte of the response from the server. Also known as time-to-first-byte.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.