Request demo

Cyber Threat Score

Score Threat Exposure Where the Work Happens.

One number for “how exposed are we” hides the part someone has to fix. The Cyber Threat Score is the scoring layer that runs through the Deepinfo Platform instead.

Each compromised account gets a risk level, each CVE a priority from CVSS, EPSS and CISA KEV, and each asset, domain and lookalike domain a score of its own.

Request demo

  1. Account risk level CTI

    1. j.@acme.example Critical
    2. c.@acme.example High
    3. m.@acme.example Low

    Reset the credential

  2. Vulnerability priority EASM

    1. CVE-2021-41773 CVSS 9.8 KEV
    2. a CVE CVSS 9.8, EPSS low
    3. a CVE CVSS 5.3, EPSS low

    Patch the CVE

  3. Security score EASM

    1. staging.acme.example
    2. www.acme.example
    3. mail.acme.example

    Watch the trend

  4. Lookalike risk score BRP

    1. acme-login.example
    2. acme-shop.example
    3. acmme.example

    Request the takedown

A Score for Each Decision.

Cyber Threat Intelligence ranks accounts, External Attack Surface Management ranks CVEs, assets and domains, and Brand Risk Protection ranks lookalike domains. The top of each list is a job someone can start today.

Account risk level · CTIRanks each employee account found in leaked credential data: Critical, High, Medium or Low
Vulnerability priority · EASMRanks each CVE on your assets: CVSS for severity, EPSS for the probability of exploitation, CISA KEV for exploitation already seen
Security score · EASMScores each asset and each domain from the issues and vulnerabilities found on it, kept as a timeline
Lookalike risk score · BRPScores each fraudulent domain next to its DNS, MX, SSL and HTTP indicators, with a timeline

How a Compromised Account Gets Its Level.

The platform describes an account’s risk level as a composite of the credential, the person’s role and how recent the exposure is.

The facts behind the level sit next to it, so an analyst can check the ranking instead of trusting it.

  • Credentials leaked for the account
  • Password strength, from very weak to very strong
  • How often leaked passwords are reused
  • First and last exposure dates
Levels
Critical · High · Medium · Low
Described as
Credential, role, recency
Distribution
GET /cti/compromised-employee-accounts/stats/risk-distribution
Trend
GET /cti/compromised-employee-credentials/stats/exposure-timeline

Read CVSS, EPSS and CISA KEV Together.

CVSS says how bad a vulnerability could be. EPSS and CISA KEV say whether anyone is likely to use it, or already has.

The queue puts the second kind first.

  • CVSS base score: how severe
  • EPSS: how likely to be exploited
  • CISA KEV: exploitation already seen

CVE on one of your assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

A Score Starts the Work. A State Ends It.

  1. 01

    Rank

    Sort compromised accounts by risk level and vulnerabilities by priority. The top of each list is where to start.

  2. 02

    Act

    Reset the credential, patch the CVE, request the takedown of the lookalike domain.

  3. 03

    Record

    Mark each leaked credential resolved, risk accepted, ignored or false positive. The decision stays on record and can be reverted.

  4. 04

    Watch the trend

    The exposure timeline counts newly exposed credentials per day, week or month, so you can see whether the flow is slowing.

See the Scores Module by Module.

EASM Risk Scoring A security score per asset and per domain, and every CVE ranked. Read CTI Executive Threat Monitoring Leadership accounts, flagged and followed. Read BRP Fraudulent Domain Monitoring Lookalike domains with a risk score timeline. Read

Query This Data Through the API

Credentials and dark web findings stay in the platform. The domain and vulnerability data around them is open through the API.

Questions About Cyber Threat Score

How is an account’s risk level set?

The platform describes the level as a composite of credential, role and recency. Each account’s page shows the inputs next to it: credentials, password strength and reuse, and exposure dates.

Can we filter accounts by risk level?

Yes. Compromised employee accounts can be searched and exported by risk level, next to department, title and the executive flag, and each one carries a numeric risk score behind its level.

Can we tell whether an account’s exposure is getting worse?

Yes. Each compromised employee account shows the days since its last exposure, how many new credentials appear per month and whether new exposures are becoming more frequent.

Can we see the trend over time?

Yes. Newly exposed credentials have an exposure timeline by day, week or month. EASM keeps a security score timeline per asset and per domain, and each fraudulent domain keeps a risk score timeline.

How do scores reach reports and alerts?

Reports run on demand or on a schedule, from the EASM Executive Summary to the CTI Email Breach Summary. Security score changes on assets and domains are among the events a notification rule can fire on.

See How Your Exposure Scores Today.

Book a walk-through on your domain.

Request demo