How is the risk score of an insight calculated?
Risk scoring starts by checking associated CVEs. If an insight has one or more linked vulnerabilities, CTI selects the highest CVSS score among them to represent the risk of that insight.
If no CVE score is available, the platform uses an AI-driven estimate based on three factors: impact, probability of exploitation, and threat level. Each factor is classified as Low, Medium, High, or Critical, and the combination determines the final result.
This model helps ensure a useful risk score even when the threat is not yet formally associated with a scored CVE. In practice, the score supports prioritization and response by balancing known technical risk with contextual inference.
A host's risk corresponds to the highest risk among the CVEs associated with that host. If no CVEs are associated with it, host risk remains undefined.
How is the Confidence Level of an IoC calculated?
The confidence level of an IoC is a metric designed to help customers and partners make decisions according to their security policies. It indicates how trustworthy the classification of a given IoC as malicious is.
This calculation is based on a multi-source analysis that considers how many security vendors identify the IoC as malicious. The data is then mapped to an internal system that classifies the indicator as Low, Medium, or High confidence.
This approach reflects consensus across trusted sources rather than relying on a single isolated reference.
CVSS (Common Vulnerability Scoring System): what is it?
CVSS is a standardized scoring system that measures the technical severity of a vulnerability. Its scale ranges from 0.0 to 10.0:
0.0 — no impact.
4.0 to 6.9 — medium severity.
7.0 to 8.9 — high severity.
9.0 to 10.0 — critical severity.
CVSS takes into account factors such as remote or local access, authentication requirements, and impact on confidentiality, integrity, and availability.
Its main limitation is that it measures technical severity, but does not indicate whether the vulnerability is actively exploited or how likely exploitation is in the short term.
EPSS (Exploit Prediction Scoring System): what is it?
EPSS estimates the probability that a vulnerability will be exploited in practice over the next 30 days. Its scale ranges from 0 to 1, where values closer to 1 indicate a higher real-world chance of exploitation.
EPSS uses machine learning and real-world data, such as exploit feeds, honeypots, telemetry, and related signals, while also considering public exploit availability, ease of exploitation, and flaw notoriety.
Its main advantage is that it helps prioritize what should be remediated first based on practical risk, not only theoretical severity. A vulnerability with critical CVSS may have very low EPSS, while another with medium CVSS may have high EPSS and therefore require more urgent action.
Used together, CVSS and EPSS provide a more complete view of risk: CVSS explains technical severity, while EPSS indicates likely real-world exploitation in the short term.
If you have any questions, feel free to reach out at [email protected] 😊