TruRisk™ Score for Tags and Business Entities
Once every asset has a TruRisk™ score, those scores roll up. A tag, a Business Entity, and your organization as a whole each carry an aggregate score on the same 0 – 1000 scale, so a department, an application, or a platform can be compared against the risk appetite you set for it.
Two formulas produce that aggregate score. Platform v1 is the default. Platform v2 is available on request. The example below shows what separates them.
Platform v1 and v2 are separate from the TruRisk™ 1.0 and 2.0 asset models. ETM customers use TruRisk™ 2.0 for asset scores, but tags and Business Entities stay on Platform v1 unless they request v2.
Which TruRisk™ Model Applies to You
The model that calculates your TruRisk™ scores depends on your subscription.
| Your subscription | Asset score | Tag and Business Entity score |
|---|---|---|
| VMDR only (also CSAM) | TruRisk™ 1.0 | Platform v1 |
| ETM enabled | TruRisk™ 2.0 (turns on automatically, in all Qualys applications) | Platform v1 |
Enabling ETM changes how asset scores are calculated. It does not change how tag and Business Entity scores are calculated.
This page assumes you know how a single asset is scored. If you do not, start with TruRisk™ Score for Assets.
Why One Critical Asset Disappears in a Crowd
A Business Entity called Retail Platform contains 100 assets. Three of them are payment servers carrying severe, exploitable risk. The other 97 are well-patched workstations.
| Assets | Asset Risk Score | Band |
|---|---|---|
| 3 payment servers | 950 | Critical |
| 97 workstations | 150 | Low |
Platform v1 takes the arithmetic mean of the member asset scores:
(3 × 950) + (97 × 150) = 17,400
17,400 ÷ 100 assets = 174 — a Low score for the entity
Three assets that an attacker could compromise today are reported as Low risk. The problem compounds as the entity grows. Onboard another 100 well-patched workstations at an ARS of 120 and the entity score becomes:
17,400 + 12,000 = 29,400
29,400 ÷ 200 assets = 147
The score improved, and nothing was remediated. The three payment servers are exactly as exposed as they were. Under an averaging model, adding safe assets is indistinguishable from fixing unsafe ones — which is why v1 can give a false sense of security, and why the score does not always move in the direction you expect when risk is added or resolved.
Platform v2 starts from the worst asset in scope rather than the typical one. MaxARS is 950, and after the g multiplier for the Critical band, the entity is already at 855 before any counts are added — a Critical score, which is what the entity actually is. Onboarding a hundred healthy workstations does not change MaxARS, so it does not lower the score. Remediating the payment servers does.
How the Two Models Compare
| Aspect | v1 (Average-based) | v2 (Risk-aware) |
|---|---|---|
| Scoring method | Simple average of member asset scores | Weighted by asset severity band |
| Unit of risk | Asset TruRisk™ Score | Asset Risk Score (ARS), banded |
| g value | Not used | g(MaxARS) — attenuates: 0.9 / 0.8 / 0.7 |
| Risk sensitivity | Score may not move intuitively when risk is added or remediated | Every addition raises the score; every fix lowers it |
| Risk visibility | Critical assets are diluted by large numbers of low-risk assets | Critical risk stays prominent regardless of volume |
| Explainability | Basic; can give a false sense of security | Changes trace back to specific assets |
| Volume caps | None | Medium and Low counts capped at 2000 |
| Customizable | No | Volume caps for Critical and High assets; High weight when no Critical assets are present |
| How to enable | Default | Contact Qualys Support |
| Best suited to | Uniform-risk environments, simple reporting, preliminary scoring | Mixed-risk environments, executive reporting, and accurate exposure visibility |
Enabling ETM upgrades the asset formula to TruRisk™ 2.0, but it does not change the platform formula. Tags and Business Entities stay on v1 until you request v2.
The Formulas
Platform v1 — Tag or Business Entity
Tag TruRisk™ = ∑(Asset TruRisk™) / Number of Assets
where,
- Asset TruRisk™: TruRisk™ score assigned to an individual asset based on its vulnerabilities and misconfigurations
- Number of Assets: Total assets under the tag
Platform v2 — Tag or Business Entity
TruRisk™ = [MaxARS * g(MaxARS)] +
[numCriticalARS * WtCritical] +
[numHighARS * WtHigh] +
[numMediumARS * WtMed] +
[numLowARS * WtLow]
where,
- MaxARS: Highest Asset Risk Score in scope
- g(MaxARS): A multiplier that attenuates the maximum so that counts can contribute without pushing the score past the scale — 0.9 / 0.8 / 0.7
- numCriticalARS: Number of critical ARS in scope (850 – 1000)
- numHighARS: Number of high ARS in scope (700 – 849)
- numMediumARS: Number of medium ARS in scope (500 – 699)
- numLowARS: Number of low ARS in scope (0 – 499)
- WtCritical, WtHigh, WtMed, WtLow: Contributions from each band
The g values and weights have default settings and can be customized for your subscription.