Measure Risk Reduction Effectiveness
Measure the effectiveness of your risk reduction program to confirm that remediation lowers risk where it matters most and to report results to stakeholders.
Measures to Use
| Measure | What it shows | Where to find it |
|---|---|---|
| Change in organization TruRisk Score | Overall risk reduction for the selected period. | Home > TruRisk Summary > Score Change |
| TruRisk Score compared with company risk appetite | Whether overall risk is within the accepted level. | Home > Trend chart |
| Business entities above risk appetite | How many business areas still exceed their accepted risk level. | Home > Risk Appetite card |
| Critical internet-exposed assets | Whether the most exposed, highest-risk assets are decreasing. | Home > Asset Exposure card |
| Plan progress | The percentage of findings in a plan that have been remediated. | Risk Management > Risk Workbench |
| Projected compared with actual reduction | Whether remediation delivered the Potential TruRisk Reduction calculated for the plan. | Risk Management > Risk Workbench (plan details) and Home |
| Ruled-out exposures | The number of vulnerabilities found to be non-exploitable after TruConfirm validation. | TruConfirm > Overview |
Interpret the Results
- If the TruRisk Score doesn't decrease after remediation, check the Last Calculated time and confirm that the source has reported the findings as resolved.
- If the score decreases mainly because findings are accepted or marked false positive, the actual exposure may not have changed. Review these decisions regularly.
- If new findings offset the reduction, the score can stay flat even when remediation is effective. Compare plan progress with the overall trend.
To confirm that remediation actually closed the exposure, see Remediation Validation.