Understanding Risk Scores
The Attack Surface Management service provides two types of risk scores.
Asset Risk Score—a risk score for every asset in the organization calculated based on the asset characteristics and their engagement with malicious activities. An Asset Risk Score is provided on the ASM report details page. See Viewing Attack Surface Management Report Details for details.
Attack Surface Grade—a risk grade for organization assets, which is calculated based on the average attack risk score of all organization assets. An Attack Surface Grade is displayed in a widget on the Attack Surface Management page and ASM report details page. See Accessing Attack Surface Management History and Viewing Attack Surface Management Report Details for details.
Asset Risk Score
An Asset Risk Score is a calculated number (score) assigned to every asset in the organization. It is calculated based on the asset characteristics (open ports, expired certificates, CVEs, EOL software, and so on.) and their engagement in malicious activities. An Asset Risk Score is available on the ASM report details page. See Viewing Attack Surface Management Report Details for details.
Below is the table displaying the distribution of points between asset characteristics.
| Asset Characteristic | Points/Item | Example |
|---|---|---|
| CVEs | 0 | 20 CVEs = 0 points |
| CVEs with Documented Exploits | 3 | 3 exploitable CVEs = 9 points |
| Exploited CVEs | 5 | 2 exploted CVEs = 10 points |
| Possible Remote Code Execution (RCE) | 5 | 5 possible RCEs = 25 points |
| Critical CVEs | 4 | 6 critical CVEs = 24 points |
| High-risk CVEs | 3 | 3 high-risk CVEs = 9 points |
| Medium-risk CVEs | 2 | 5 medium-risk CVEs = 10 points |
| Low-risk CVEs | 1 | 7 low-risk CVEs = 7 points |
| End-of-life Software | 3 | 2 EOL software = 6 points |
| Expired Certificates | 1 | 2 expired certificates = 2 points |
| Self-signed Certificates | 1 | 2 self-signed certificates = 2 points |
| Uncommon Ports | 3 | 3 open uncommon ports = 9 points |
| Risky Services | 5 | 2 risky services open to the Internet = 10 points |
All ports except 443 and 80 are considered uncommon.
The following services are considered risky:
ftps, ssh, telnet, ftp, ftpes, rdp, VNC, TEAM_VIEWER, PC_ANYWHERE, MYSQL, MSSQL, ORACLE, POSTGRES, MEMCACHED, ELASTICSEARCH, REDIS, MONGODB, RETHINKDB, UNKNOWN.
An Asset Risk Score is the total of all points for an asset. The minimum possible score is 0 and the maximum score is 100. The lower the score, the lower the risk of attacks on the asset. If the total score is greater than 100, it is rounded to 100 in the ASM report.
Attack Surface Grade
An Attack Surface Grade reflects the overall grade for all organization assets. The Attack Surface Grade is based on the average risk score of all assets of the organization. The average score does not include the assets whose Asset Risk Score is equal to 0.
For the Attack Surface Grade, the scores are distributed the following way:
| Grade | Score |
|---|---|
| A+ | 93.33 - 100 |
| A | 86.67 - 93.33 |
| A- | 80 - 86.67 |
| B+ | 73.33 - 80 |
| B | 66.67 - 73.33 |
| B- | 60 - 66.67 |
| C+ | 53.33 - 60 |
| C | 46.67 - 53.33 |
| C- | 40 - 46.67 |
| D+ | 33.33 - 40 |
| D | 26.67 - 33.33 |
| D- | 20 - 26.67 |
| F | 0 - 20 |
The lower the grade, the higher the risk of attacks on organization assets.