How is the risk score on assets calculated?

The risk score represents a score between 0 and 100 to help prioritize across your assets, whereas a higher risk score is more severe. This risk score is assigned to the unified assets, consisting of one or many assets grouped together.

The risk score is calculated through four stages for a single unified asset. We look at several data properties with a certain weight for each stage to reach the final risk score.

These are the stages for risk score calculations for a unified asset:

Stage 1: Evaluate vulnerabilities

Among all the vulnerabilities identified within the unified asset, we carefully choose a limited number of vulnerabilities from each severity tier (low, medium, high, and critical), prioritizing those known to be associated with ransomware or exploitation if more are found across different severity levels.

Stage 2: Collect the number of vulnerabilities for each asset type

Collect the number of vulnerabilities for each asset type (network, web application, devices, phishing simulation, awareness training, etc.) within this unified asset. Based on this amount, we will provide further weighting related to the scoring. Certain limitations are in place to avoid unfair weights, which cap the amount to a certain level for each asset type.

Stage 3: Evaluate the properties of the asset

• Properties of the assets are brought into the calculation to impact the final risk score further.
• The higher the business impact set on an asset, the more weight it will have on the risk score. This value can be configured by the customer on assets.
• Servers impact the weight more than clients.
• If there are known exploits or ransomware related to the vulnerabilities of an asset. This has a significant impact and will make the risk score significantly higher.
• If the asset is facing the public, it will impact the weight more on the risk score compared to a completely internal asset. This is automatically identified but can be overridden manually on the asset.

Stage 4: Final calculation and weight presentation

The drafted raw scoring is mapped to a value between 0 and 100, and the final risk score is represented on the unified asset visible in Security Center.

The risk score algorithm prioritizes and ensures that assets are relatively differentiated based on all the properties taken into account from stages 1 to 3. This makes it easier for organizations to understand the most risk and where to start prioritizing.

Risk scores are mapped to different colors to highlight the risk score as follows:

• Green: 1-10
• Yellow: 11-30
• Orange: 31-60
• Red: 61-100