Identify Risk Reduction Opportunities
A risk reduction opportunity is a set of findings or assets where action lowers the TruRisk Score the most. Use the following areas of ETM to find them.
| Where to look | What it tells you |
|---|---|
| Home > Risk Appetite card | The number of business entities whose TruRisk Score is above their risk appetite. Start with these entities. |
| Home > Business Entities panel > Top Risky | Up to four entities whose TruRisk Score is above their risk appetite, starting with the highest score. Consider business value together with the score. |
| Home > Asset Exposure card | Internet-exposed assets with a TruRisk Score in the Critical band (850–1,000). These assets are directly reachable by attackers. |
| Home > Top Risk Factors card | Risk factors present in your findings, such as CISA KEV, ransomware, threat actors, and weaponized vulnerabilities. |
| Risk Management > Findings | Findings with details such as QVSS, exploitability, risk factors, and EPSS. Use filters and Group by to narrow the list. |
| Risk Management > Findings > TruConfirm Validation Available | Findings that TruConfirm can validate, so you can confirm which are exploitable before you plan remediation. |
| Risk Management > Risk Workbench | The projected TruRisk reduction for a set of findings when you run a prioritization. |
Prioritize Opportunities
Focus first on findings that combine several of the following conditions:
- The finding is on a business-critical asset or in a business entity with high business value.
- The asset is internet facing.
- The vulnerability is actively exploited, associated with ransomware or threat actors, or has working exploit code.
- Exploitability has been confirmed by TruConfirm.
When you're ready to act, create a risk reduction plan.