The Risk Profile Score

Coverity on Polaris

Version
latest

The Risk Profile Score


A screenshot that shows the Aggregate Risk Profile Score of an application.

The Risk Profile Score is a whole number between 0 and 100 (inclusive) that reflects the security stance of the entire application. This is the number that appears in the application summary, just under the name of the application.

The score depends on a number of settings that can be changed by an organization admin. For example you can adjust the weights assigned to different tool domains or to different issue severities to make the final score more meaningful for your organization.

Scoring Applications

The Black Duck Risk Profile Score is derived by these general steps:
  1. A domain score is calculated for each testing domain (e.g. SAST and SCA)
  2. All the domain scores are used to derive an Aggregate Risk Profile Score
  3. Additional penalties are assessed, depending on the optional settings specified by the org admin

Domain Score

Note: In the case of Coverity on Polaris the only domain applicable at present is SAST.

The domain score formula takes the following into consideration:

  • The highest severity found among issues in the domain
  • The number of issues found with each level of severity (low, medium, and high)
  • The weight assigned each severity

Optional settings

Additional penalties increase the risk score, depending on the settings you choose for the following.

  • Tier – This is user-defined attribute. It allows you to factor your own variable into the calculations and add a penalty percentage that increases the final risk score.
  • Phase – Corresponds to phases of the software development lifecycle.
  • Distribution – Identifies the way the application is distributed. This can be external, open source, or internal.

Each of the optional setting can increase the final Risk Profile Score by as much as 10 percent of the Aggregate Risk Profile Score. If they are not set by an admin, they do not impact the score.