Risk scoring
Requires Pro
This feature requires a valid Pro license key.
Risk scoring combines multiple signals into a single score for each finding, helping you prioritize what to fix first.
Score factors
- Severity (40%) - finding severity (critical, high, medium, low)
- EPSS (35%) - FIRST.org exploit prediction score (for CVEs)
- Age (15%) - time since the finding was created
- Asset criticality (10%) - application-level label
EPSS integration
servasec syncs EPSS data from FIRST.org every 24 hours for findings that reference a CVE.
Score ranges
| Range | Meaning |
|---|---|
| < 0.3 | Low risk |
| 0.3 - 0.6 | Medium risk |
| >= 0.6 | High risk |
Risk scores are displayed in the findings list and detail views. The dashboard surfaces the highest-risk findings across your portfolio.