# Cyber Threat Score

URL: https://www.deepinfo.com/platform/cti/cyber-threat-score/

## Score Threat Exposure Where the Work Happens.

One number for “how exposed are we” hides the part someone has to fix. The Cyber Threat Score is the scoring layer that runs through the Deepinfo Platform instead.

Each compromised account gets a risk level, each CVE a priority from CVSS, EPSS and CISA KEV, and each asset, domain and lookalike domain a score of its own.

[Request demo](https://www.deepinfo.com/request-demo/)

### A Score for Each Decision.

Cyber Threat Intelligence ranks accounts, External Attack Surface Management ranks CVEs, assets and domains, and Brand Risk Protection ranks lookalike domains. The top of each list is a job someone can start today.

- **Account risk level · CTI**: Ranks each employee account found in leaked credential data: Critical, High, Medium or Low
- **Vulnerability priority · EASM**: Ranks each CVE on your assets: CVSS for severity, EPSS for the probability of exploitation, CISA KEV for exploitation already seen
- **Security score · EASM**: Scores each asset and each domain from the issues and vulnerabilities found on it, kept as a timeline
- **Lookalike risk score · BRP**: Scores each fraudulent domain next to its DNS, MX, SSL and HTTP indicators, with a timeline

### How a Compromised Account Gets Its Level.

The platform describes an account’s risk level as a composite of the credential, the person’s role and how recent the exposure is.

The facts behind the level sit next to it, so an analyst can check the ranking instead of trusting it.

- Credentials leaked for the account
- Password strength, from very weak to very strong
- How often leaked passwords are reused
- First and last exposure dates

- **Levels**: Critical · High · Medium · Low
- **Described as**: Credential, role, recency
- **Distribution**: `GET /cti/compromised-employee-accounts/stats/risk-distribution`
- **Trend**: `GET /cti/compromised-employee-credentials/stats/exposure-timeline`

### Read CVSS, EPSS and CISA KEV Together.

CVSS says how bad a vulnerability could be. EPSS and CISA KEV say whether anyone is likely to use it, or already has.

The queue puts the second kind first.

- CVSS base score: how severe
- EPSS: how likely to be exploited
- CISA KEV: exploitation already seen

### A Score Starts the Work. A State Ends It.

1. **Rank**

   Sort compromised accounts by risk level and vulnerabilities by priority. The top of each list is where to start.
2. **Act**

   Reset the credential, patch the CVE, request the takedown of the lookalike domain.
3. **Record**

   Mark each leaked credential resolved, risk accepted, ignored or false positive. The decision stays on record and can be reverted.
4. **Watch the trend**

   The exposure timeline counts newly exposed credentials per day, week or month, so you can see whether the flow is slowing.

### See the Scores Module by Module.

- [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) (EASM): A security score per asset and per domain, and every CVE ranked.
- [Executive Threat Monitoring](https://www.deepinfo.com/platform/cti/executive-threat-monitoring/) (CTI): Leadership accounts, flagged and followed.
- [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (BRP): Lookalike domains with a risk score timeline.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Cyber Threat Score

**How is an account’s risk level set?**

The platform describes the level as a composite of credential, role and recency. Each account’s page shows the inputs next to it: credentials, password strength and reuse, and exposure dates.

**Can we filter accounts by risk level?**

Yes. Compromised employee accounts can be searched and exported by risk level, next to department, title and the executive flag, and each one carries a numeric risk score behind its level.

**Can we tell whether an account’s exposure is getting worse?**

Yes. Each compromised employee account shows the days since its last exposure, how many new credentials appear per month and whether new exposures are becoming more frequent.

**Can we see the trend over time?**

Yes. Newly exposed credentials have an exposure timeline by day, week or month. EASM keeps a security score timeline per asset and per domain, and each fraudulent domain keeps a risk score timeline.

**How do scores reach reports and alerts?**

Reports run on demand or on a schedule, from the EASM Executive Summary to the CTI Email Breach Summary. Security score changes on assets and domains are among the events a notification rule can fire on.

### See How Your Exposure Scores Today.

Book a walk-through on your domain.

[Request demo](https://www.deepinfo.com/request-demo/)