Understand Risk Reduction
Risk reduction lowers the risk in your environment so that it stays within your risk appetite. In ETM, risk is measured by the TruRisk Score, so risk reduction is the decrease in TruRisk Score that results from the actions you take on findings and assets.
How ETM Measures Risk Reduction
ETM calculates a TruRisk Score from 0 to 1,000 for each asset and aggregates it for business entities and the organization. The score combines the Qualys Detection Score (QDS) of findings with the Asset Criticality Score (ACS) of assets. When a finding that contributes to the score is resolved or excluded, the score decreases after ETM recalculates it.
Compare the TruRisk Score with the configured risk appetite to decide whether more action is required:
- Score above risk appetite: Risk is above the level your organization accepts. Plan risk reduction for this area.
- Score below risk appetite: Risk is within the accepted level. Continue to monitor it.
Ways to Reduce Risk
ETM supports several ways to lower the TruRisk Score. Each way has a different effect on your actual exposure:
| Action | Effect on risk |
|---|---|
| Remediate findings | Patching or fixing a vulnerability or misconfiguration removes the exposure. This is the most direct way to reduce risk. |
| Apply compensatory factors | Security controls that reduce exposure can be accounted for as compensatory factors, which adjust the TruRisk Score. |
| Validate exploitability | TruConfirm confirms whether a vulnerability is exploitable in your environment and updates the QVSS score of the finding. Findings that aren't exploitable can be deprioritized. |
| Accept risk or mark a false positive | Findings marked as risk accepted or false positive are excluded from the TruRisk calculation. The score decreases, but the underlying issue isn't fixed, so use these options only when the decision is documented and approved. |
Risk Reduction Lifecycle
Risk reduction is continuous. New assets, vulnerabilities, and threats change the level of risk, so you repeat the following cycle:
- Identify the actions that reduce the most risk.
- Create plans to carry out those actions.
- Track the progress of each plan.
- Measure the result against your risk appetite.