Risk analysis : a score, and why

"Risk analysis" page

This page answers one simple question: "overall, where do we stand?". It gives a score, and above all explains where it comes from. Two tabs.

"Risk scores" tab

A large circle shows your fleet's overall score, a weighted average across all your machines. Under the circle, the recipe is written out in plain sight: 35% comes from settings compliance, 40% from alerts, and 25% from critical vulnerabilities.

Two reassuring details come with the figure. First, the false positives you declared are taken out of the calculation: the score reflects your reality, not the noise. Second, disconnected machines are excluded, a switched-off laptop does not drag your score down.

The score is recalculated at least every four hours, and the page shows the time of the last calculation.

"Attack techniques" tab

The second tab sorts alerts against a worldwide reference of known attack methods. A heat map shows the families most often seen, and a table lists the techniques by number of detections.

On a healthy fleet this tab often reads "no technique detected". That is good news, not a breakdown: data only appears when matching alerts are generated. The screen explains this itself, rather than leaving you with an empty table.