The Risk Profile Score
The Risk Profile Score is a whole number between 0 and 100 (inclusive) that reflects the security stance of the entire application. This is the number that appears in the application summary, just under the name of the application.
The score depends on a number of settings that can be changed by an organization admin. For example you can adjust the weights assigned to different tool domains or to different issue severities to make the final score more meaningful for your organization.
Scoring Applications
- A domain score is calculated for each testing domain (e.g. SAST and SCA)
- All the domain scores are used to derive an Aggregate Risk Profile Score
- Additional penalties are assessed, depending on the optional settings specified by the org admin
Domain Score
The domain score formula takes the following into consideration:
- The highest severity found among issues in the domain
- The number of issues found with each level of severity (low, medium, and high)
- The weight assigned each severity
Optional settings
Additional penalties increase the risk score, depending on the settings you choose for the following.
- Tier – This is user-defined attribute. It allows you to factor your own variable into the calculations and add a penalty percentage that increases the final risk score.
- Phase – Corresponds to phases of the software development lifecycle.
- Distribution – Identifies the way the application is distributed. This can be external, open source, or internal.
Each of the optional setting can increase the final Risk Profile Score by as much as 10 percent of the Aggregate Risk Profile Score. If they are not set by an admin, they do not impact the score.