Does a green security dashboard score tell you how exposed you are to real attacks, or only how many of your chosen checks happen to pass?
The scores count passing checks. Microsoft, AWS, Google, Vanta, Drata and CIS all document them as the share of passing checks within a chosen scope, and several say outright that the score doesn't measure breach likelihood. Which means a score can go green without anything changing: suppress a finding, exclude a resource, or simply have no resources for a check, and the number improves. The public record also holds cases where the report was clean and the attacker's route was open, at Marriott, Hannaford, Target, Heartland and Equifax, though nobody has counted how common that is, so those are illustrations rather than a rate.
There's evidence the other way and it's reasonable. Insurer and ratings studies link hardening, full MFA, fast patching and Cyber Essentials certification to fewer incidents. Those are correlational and often vendor-run, but they aren't nothing, and they're about the controls the dashboard is counting. What nobody has done is test the dashboards themselves: I couldn't find a single study checking whether a vendor dashboard score predicts incidents.
So the score describes your configuration against a vendor's rule set, which is a real thing to know and not the thing people read it as. I'd audit the suppressions, exclusions and attestations sitting behind it and state its scope, then report it next to actual exposure: known exploited vulnerabilities still open, exposed services, patching coverage and speed. I wouldn't throw the control-status score away, because a single unvalidated exposure score is no better.