Skip to main content

Risk Models

Risk models translate multiple signals into a single prioritization outcome. In Cloudaware, they determine which vulnerabilities appear at the top of work queues and how SLAs are applied.

This guide describes the inputs commonly used to calculate vulnerability risk, the scoring models organizations apply, and how those risk values are used in Cloudaware to prioritize remediation and reporting.

Inputs to Risk Models​

Common inputs include:

  • Scanner severity – Critical/High/Medium/Low.
  • CVSS base scores and vectors
  • Exploitability – known exploited status, public exploit availability.
  • Exposure – internet‑facing vs internal, production vs non‑production, open ports.
  • Business impact – asset criticality and data sensitivity from CMDB.
  • Age – how long the vulnerability has existed on the asset.

See Severity & Scoring for how these inputs are stored.

Example Risk Model Patterns​

Simple Banding​

  • Start with scanner severity.
  • Elevate issues on internet‑facing, production systems by one band.
  • Lower non‑production findings by one band (except Critical).

Example:

  • A High‑severity vulnerability on an internet‑facing production server is treated as Critical.
  • A Medium‑severity issue on a non‑production server may be treated as Low.

Weighted Numeric Score​

Assign weights to each input and compute a numeric risk score, for example:

  • RiskScore = 0.4 * CVSS + 0.2 * Exposure + 0.2 * AssetCriticality + 0.1 * Exploitability + 0.1 * AgeFactor

Then map:

  • 9–10 → CRITICAL
  • 7–8.9 → HIGH
  • 4–6.9 → MEDIUM
  • 0–3.9 → LOW

Compliance‑Driven Model​

Prioritize vulnerabilities that:

  • Affect regulated or in‑scope systems (e.g., PCI, HIPAA).
  • Are overdue relative to mandated SLAs (e.g., Critical > 30 days).

Use risk bands to drive compliance dashboards and escalation reports.

Operationalizing Risk in Cloudaware​

  • Store risk bands or scores on Vulnerability Scan records or related summary objects.
  • Use these fields to:

Review and adjust your risk model periodically as threat landscapes and business priorities change.