Skip to main content

Risk scoring

Requires Pro

This feature requires a valid Pro license key.

Added in v0.3.0

Risk scoring combines multiple signals into a single score for each finding, helping you prioritize what to fix first.

Score factors​

  • Severity (40%) - finding severity (critical, high, medium, low)
  • EPSS (35%) - FIRST.org exploit prediction score (for CVEs)
  • Age (15%) - time since the finding was created
  • Asset criticality (10%) - application-level label

EPSS integration​

servasec syncs EPSS data from FIRST.org every 24 hours for findings that reference a CVE.

Score ranges​

RangeMeaning
< 0.3Low risk
0.3 - 0.6Medium risk
>= 0.6High risk

Risk scores are displayed in the findings list and detail views. The dashboard surfaces the highest-risk findings across your portfolio.