Request demo

Security Risk Scoring

One Scoring Engine for You and Every Vendor.

A risk score is worth reporting when it reflects what attackers exploit and means one thing across organizations. Security Risk Scoring runs one engine across your surface and all vendor portfolios, ranks CVEs by CVSS, EPSS and CISA KEV together, and keeps a timeline for each score.

Request demo

  1. Asset

    score decreased

  2. Domain

  3. Attack surface

  4. Issue type and category

    Certificates what moved the number

  5. Third partysame engine

Why Risk Numbers Fall Apart.

A score earns trust when it survives the follow-up question. Here is why many don’t.

Severity only

CVSS Sorts by What Could Happen

A queue sorted by CVSS puts every critical on top, exploited or not. The number looks alarming and says little about likelihood.

Different math

Vendors Scored Another Way

When vendor scores come from questionnaires and your own from a scanner, the two numbers can’t be compared.

Black box

A Number Nobody Can Open

If a score can’t be traced to the findings behind it, the board’s next question ends the conversation.

Rank Severity With Likelihood in One List.

CVSS, EPSS and CISA KEV read together. What CISA KEV lists gets fixed first, and a high CVSS with a negligible EPSS waits for the normal patch cycle.

CVE on one of your assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

A Score at Every Level You Report.

Scores are kept as time series, so the direction is visible as well as the level.

LevelWhat it covers
AssetOne domain, subdomain or IP address
DomainA domain with all its subdomains and websites
Attack surfaceEverything you monitor
Issue type and categoryOne kind of issue across your assets, which shows what moved the number
Third partyA vendor’s portfolio, scored by the engine that scores your surface

Levels for your surface come from Risk Scoring, vendor portfolios from Vendor Risk Scoring. Each CVE carries CVSS v2 to v4.0 metrics where published, vDeep (Deepinfo’s own CVSS scoring layer), EPSS with its percentile, and its CISA KEV entry where listed.

Your Vendors Sit on Your Scale.

Third-Party Risk Management runs the External Attack Surface Management engine on each vendor’s portfolio, so two vendors compare directly and both compare with you. When a vendor’s score falls, the findings behind it are listed with their evidence, ready for the conversation with the vendor.

  1. acme.example

    Yours · your own surface

    A

  2. payroll.example

    Vendor · linked to you

    C→D

    • remote.payroll.example · 3389/tcp newly open Critical · not on the vendor’s list
    • docs.payroll.example · CVE-2021-41773 Critical KEV
    • The way in: payroll.example → acme.example. Their exposure becomes yours.

  3. cloud-hosting.example

    A

  4. cdn-provider.example

    A

  5. logistics-co.example

    B

  6. law-firm.example

    C

  7. call-center.example

    C

  8. marketing-agency.example

    B

  9. subsidiary-eu.example

    B

  10. crm-saas.example

    A

Where the Score Does Its Work.

Leadership Reporting

The score timeline shows direction as well as level. The EASM Executive Summary report runs on demand or on a schedule.

Procurement Gates

Add a prospective vendor as a portfolio and read its score and findings before the contract. A major bank in our customer stories gates vendor onboarding on the score.

Story

Remediation Priorities

Scores per issue type and issue category show what is pulling the number down, so the next sprint targets the biggest mover.

Business Weight

Set a weight on the assets that matter most, so the payment stack stands apart from a brochure site.

Score Alerts

Notification events watch the scores: an asset’s or a domain’s score decreased or changed, delivered instantly or as a digest.

This Score Feeds Other Workflows.

Customer story An industrial conglomerate Consistent scoring across 30+ subsidiary brands makes risk comparable across the group. Read Use case Cyber Insurance Assessment An applicant’s surface, scored and tracked through the policy term. Read Use case Third-Party Risk Management Vendor risk that rests on evidence, not questionnaires. Read

Use This Data in Your Tools

Your tools can look up any company’s domains, subdomains and registration data through the API, from the index the Deepinfo Platform scans vendors with.

Questions About Security Risk Scoring

What goes into the score?

The issues active on the assets in scope, with vulnerabilities ranked by CVSS, EPSS and CISA KEV together. Scores are also kept per issue type and category, so every change traces back to its cause. The methodology page covers how scanning and scoring fit together.

Why not rank vulnerabilities by CVSS alone?

CVSS describes how severe a vulnerability could be. EPSS estimates the probability of exploitation in the next 30 days and CISA KEV lists vulnerabilities already exploited, so a KEV-listed high can rightly outrank a critical nobody exploits.

Is the scoring formula published?

No, the formula itself is not published. Each score can still be opened down to the issues behind it, with the evidence that raised each one.

How does a score go back up?

By fixing what was found. Once a rescan confirms a fix, the issue moves to verified resolved and the change shows in the next score snapshot.

Can we pull scores into our own dashboards?

Yes. Score timelines per asset, per domain and for the whole surface are endpoints in the EASM API, next to the issue and vulnerability severity timelines.

See Your Score and What’s Behind It.

Bring your critical vendors to a demo and score them next to yours.

Request demo