Request demo

Risk Scoring

Score Each Asset and See the Signal Underneath.

A list sorted by CVSS puts the criticals at the top, whether or not anyone is exploiting them. The platform scores each asset, each domain and your whole attack surface, and ranks the CVEs underneath with CVSS, EPSS and CISA KEV together.

Leadership reads the score and its trend. Analysts break it down by asset, by issue type and by issue category to see what moved it.

Request demo
    • CVE-2021-41773 · staging.acme.example CVSS 9.8CISA KEV

  2. Assetstaging.acme.example

    asset_security_score_decreased

  3. Domainacme.example

  4. Attack surface

weekly /easm/assets/ASSET_ID/stats/security-score-timeline?interval=weekly

CVSS, EPSS and KEV Sit Under Every CVE.

Each one answers a different question. Together they separate the vulnerabilities worth an emergency change from the ones that can wait for the next patch cycle.

How bad

CVSS

How severe the vulnerability would be if exploited. The platform keeps CVSS v2, v3.0, v3.1 and v4.0 metrics where published, and adds vDeep, Deepinfo’s own CVSS scoring layer.

How likely

EPSS

The Exploit Prediction Scoring System’s estimate of the probability that the CVE is exploited in the next 30 days, with its percentile against all other CVEs.

Already happening

CISA KEV

Whether CISA lists the CVE as exploited in the wild, with the date it was added, the due date, the required action and any known ransomware campaign use.

Fix What Is Likely to Be Used First.

Rank the CVEs on your assets by what attackers exploit, not by severity alone, and the order becomes clear. The ones CISA KEV lists go first.

A high CVSS with a negligible EPSS and no KEV listing waits for the normal patch cycle instead of triggering an emergency change. The queue your team works from is sorted that way from the start.

CVE on one of your assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

A Score at Each Level.

Scores are kept as time series, so the direction is visible as well as the number. Asset and domain timelines can be read per day, week or month.

AssetOne domain, subdomain or IP address
DomainA domain with all its subdomains and websites
Attack surfaceEverything you monitor
Issue typeOne kind of issue across your assets
Issue categoryA family of related issue types

Each score has its own security score timeline. Scores per issue type and per issue category show which kind of issue moved the number.

A Falling Score Reaches Its Owner.

Notification events watch the scores: an asset’s score decreased or changed, and a domain’s score decreased or changed. Rules can be scoped to assets or tags and delivered instantly or as an hourly, daily, weekly or monthly digest.

These timelines are also available through the API, for your dashboards or a quarterly review.

  • asset_security_score_decreased
  • asset_security_score_changed
  • domain_security_score_decreased
  • domain_security_score_changed
Asset Security Score Timeline reference
Score timeline 
# Weekly security score of one asset
curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/stats/security-score-timeline?interval=weekly" \
  -H "apikey: YOUR_API_KEY"

Turn a Score Into a Worklist.

Business Weight

Record how much an asset matters as a weight from 0 to 1000, set by filter on any group of assets, such as everything tagged for payments.

Assets With the Most Issues

A ranked list of the assets carrying the most active issues, a direct starting point for a remediation sprint.

Most Vulnerable Technologies

The products on your surface with the most vulnerabilities, each with its versions and the assets that run it.

Known Exploited, Counted

How many vulnerabilities on your assets are listed in CISA KEV, next to their distribution by exploitability score.

Framework View

Issues filtered by their OWASP Top 10 2021, PCI DSS 4.0 or 3.2, HIPAA, CWE, CAPEC or WASC classification, then exported as CSV or JSON for the auditor.

Where the Score Goes Next.

EASM Remediation Work the ranked queue until a rescan confirms each fix. Read TPRM Vendor Risk Scoring Vendors scored on the scale used for your surface. Read Use case Security Risk Scoring Your surface and your vendors, scored side by side. Read

Query This Data Through the API

The subdomains, DNS records, certificates, ports and technologies this module finds come from Deepinfo’s own index. Your developers can query it through the API.

Questions About Risk Scoring

What goes into the security score?

The issues and vulnerabilities found on your assets, with each CVE ranked by CVSS, EPSS and CISA KEV together. The platform also keeps a score per issue type and per issue category, so a change in the total can be traced to the kind of issue behind it. See methodology for how the platform collects, scans and scores.

Why not sort vulnerabilities by CVSS alone?

CVSS describes how severe a vulnerability could be, not whether anyone is using it. EPSS adds the probability of exploitation in the next 30 days and CISA KEV confirms exploitation in the wild, so a KEV-listed high can rightly rank above a critical with a negligible EPSS and no KEV listing.

Can a CVE with a low EPSS score wait?

It can wait its turn, but it stays on the list. EPSS estimates likelihood and KEV lists confirmed exploitation, so a CVE with a low score and no listing can still be exploited; the ranking orders the work without closing any of it.

Can we recalculate a score after a fix?

Yes, once a rescan confirms the fix. Scan the asset on demand, and an instant snapshot then recalculates the score and statistics of the asset, its domain or your whole attack surface.

Are third parties scored the same way?

Yes. Third-Party Risk Management runs the same scanning and scoring on each vendor’s attack surface, so a vendor’s score and yours sit on one scale.

Can we pull scores into our own dashboards?

Yes. All score timelines are available through the EASM API, next to the issue and vulnerability severity timelines.

See How Your Assets Score.

Book a walk-through of scoring on your domain.

Request demo