# Risk Scoring URL: https://www.deepinfo.com/platform/easm/complete-risk-scoring/ ## Score Each Asset and See the Signal Underneath. A list sorted by CVSS puts the criticals at the top, whether or not anyone is exploiting them. The Deepinfo Platform scores each asset, each domain and your whole attack surface, and ranks the CVEs underneath with CVSS, EPSS and CISA KEV together. Leadership reads the score and its trend. Analysts break it down by asset, by issue type and by issue category to see what moved it. [Request demo](https://www.deepinfo.com/request-demo/) ### CVSS, EPSS and KEV Sit Under Every CVE. Each one answers a different question. Together they separate the vulnerabilities worth an emergency change from the ones that can wait for the next patch cycle. How bad #### CVSS How severe the vulnerability would be if exploited. The platform keeps CVSS v2, v3.0, v3.1 and v4.0 metrics where published, and adds vDeep, Deepinfo’s own CVSS scoring layer. How likely #### EPSS The Exploit Prediction Scoring System’s estimate of the probability that the CVE is exploited in the next 30 days, with its percentile against all other CVEs. Already happening #### CISA KEV Whether CISA lists the CVE as exploited in the wild, with the date it was added, the due date, the required action and any known ransomware campaign use. ### Fix What Is Likely to Be Used First. Rank the CVEs on your assets by what attackers exploit, not by severity alone, and the order becomes clear. The ones CISA KEV lists go first. A high CVSS with a negligible EPSS and no KEV listing waits for the normal patch cycle instead of triggering an emergency change. The queue your team works from is sorted that way from the start. ### A Score at Each Level. Scores are kept as time series, so the direction is visible as well as the number. Asset and domain timelines can be read per day, week or month. - **Asset**: One domain, subdomain or IP address - **Domain**: A domain with all its subdomains and websites - **Attack surface**: Everything you monitor - **Issue type**: One kind of issue across your assets - **Issue category**: A family of related issue types Each score has its own security score timeline. Scores per issue type and per issue category show which kind of issue moved the number. ### A Falling Score Reaches Its Owner. Notification events watch the scores: an asset’s score decreased or changed, and a domain’s score decreased or changed. Rules can be scoped to assets or tags and delivered instantly or as an hourly, daily, weekly or monthly digest. These timelines are also available through the API, for your dashboards or a quarterly review. - `asset_security_score_decreased` - `asset_security_score_changed` - `domain_security_score_decreased` - `domain_security_score_changed` [Asset Security Score Timeline reference](https://docs.deepinfo.com/reference/easm/asset-security-score-timeline/) Score timeline ```bash # Weekly security score of one asset curl "https://api.deepinfo.com/v1/easm/assets/ASSET_ID/stats/security-score-timeline?interval=weekly" \ -H "apikey: YOUR_API_KEY" ``` ### Turn a Score Into a Worklist. #### Business Weight Record how much an asset matters as a weight from 0 to 1000, set by filter on any group of assets, such as everything tagged for payments. #### Assets With the Most Issues A ranked list of the assets carrying the most active issues, a direct starting point for a remediation sprint. #### Most Vulnerable Technologies The products on your surface with the most vulnerabilities, each with its versions and the assets that run it. #### Known Exploited, Counted How many vulnerabilities on your assets are listed in CISA KEV, next to their distribution by exploitability score. #### Framework View Issues filtered by their OWASP Top 10 2021, PCI DSS 4.0 or 3.2, HIPAA, CWE, CAPEC or WASC classification, then exported as CSV or JSON for the auditor. ### Where the Score Goes Next. - [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) (EASM): Work the ranked queue until a rescan confirms each fix. - [Vendor Risk Scoring](https://www.deepinfo.com/platform/tprm/automated-risk-scoring/) (TPRM): Vendors scored on the scale used for your surface. - [Security Risk Scoring](https://www.deepinfo.com/solutions/use-cases/security-risk-scoring/) (Use case): Your surface and your vendors, scored side by side. ### Query This Data Through the API The subdomains, DNS records, certificates, ports and technologies this module finds come from Deepinfo’s own index. Your developers can query it through the API. - [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) - [DNS Lookup API](https://www.deepinfo.com/data-api/apis/dns-lookup/) - [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/) - [Port Scan API](https://www.deepinfo.com/data-api/apis/port-scan/) - [Technology Lookup API](https://www.deepinfo.com/data-api/apis/technology-lookup/) - [All Subdomains Feed](https://www.deepinfo.com/data-api/feeds/all-subdomains/) ### Questions About Risk Scoring **What goes into the security score?** The issues and vulnerabilities found on your assets, with each CVE ranked by CVSS, EPSS and CISA KEV together. The platform also keeps a score per issue type and per issue category, so a change in the total can be traced to the kind of issue behind it. See [methodology](https://www.deepinfo.com/methodology/) for how the platform collects, scans and scores. **Why not sort vulnerabilities by CVSS alone?** CVSS describes how severe a vulnerability could be, not whether anyone is using it. EPSS adds the probability of exploitation in the next 30 days and CISA KEV confirms exploitation in the wild, so a KEV-listed high can rightly rank above a critical with a negligible EPSS and no KEV listing. **Can a CVE with a low EPSS score wait?** It can wait its turn, but it stays on the list. EPSS estimates likelihood and KEV lists confirmed exploitation, so a CVE with a low score and no listing can still be exploited; the ranking orders the work without closing any of it. **Can we recalculate a score after a fix?** Yes, once a rescan confirms the fix. Scan the asset on demand, and an instant snapshot then recalculates the score and statistics of the asset, its domain or your whole attack surface. **Are third parties scored the same way?** Yes. [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) runs the same scanning and scoring on each vendor’s attack surface, so a vendor’s score and yours sit on one scale. **Can we pull scores into our own dashboards?** Yes. All score timelines are available through the [EASM API](https://docs.deepinfo.com/reference/easm/), next to the issue and vulnerability severity timelines. ### See How Your Assets Score. Book a walk-through of scoring on your domain. [Request demo](https://www.deepinfo.com/request-demo/)