Understand the Risk Workbench
You have many findings, and only so much time. The Risk Workbench helps you answer one question: which fixes will lower my risk the most? It ranks your findings by the risk they carry, shows how much your TruRisk™ score can drop, and lets you save the result as a plan.
Navigate to: Risk Management > Risk Workbench
Understand the Risk Workbench
Not every finding carries the same risk. A few findings on a few important assets often make up most of your risk. The Risk Workbench helps you find them.
In the Risk Workbench, you create prioritization plans. A prioritization plan is a saved list of the findings you choose to fix first. For each plan, ETM shows the TruRisk score you can reach after you fix those findings.
Every plan follows the same simple path:
| Step | What you do | Details |
|---|---|---|
| 1. Scope | Pick what to look at | Select Business Entities or asset tags. |
| 2. Approach | Choose how to rank | Use Highest Risk Reduction, or your own filters. |
| 3. Prioritize | See the impact | Review the ranked findings and the projected score. |
| 4. Save | Keep your plan | Find it again on the Risk Workbench tab. |
For step-by-step instructions to create a plan, see Prioritization Workflow.
Key Terms
| Term | What it means |
|---|---|
| Prioritization plan | A saved list of findings, within a scope you choose, that you plan to fix first. |
| Scope | The assets the plan covers. You select one or more Business Entities, or asset tags. |
| Prioritization approach | How findings are ranked. Use Highest Risk Reduction, or click Let Me Decide to choose your own filters. |
| Template | A saved set of filters that you can reuse to create new plans. |
| Projected TruRisk score | The TruRisk score you can reach if you fix the findings in the plan. |
| Risk factors | The conditions that make a finding more likely to be exploited, or more harmful if it is. |
Before You Begin
Group your assets into Business Entities, or tag them, so you can choose a scope for your plan.
Analyze Risk
Start with the big picture. When you click Prioritize Now, ETM finds the findings that matter most in your scope and works out how much risk you remove by fixing them.
Example: Your TruRisk score today is 900. After you fix the findings in one plan, the projected score is 580. A small, focused set of fixes can make a big difference to your score.
What to Look At
| Item | What it tells you |
|---|---|
| Projected TruRisk reduction | Compare your current TruRisk score with the score you can reach after you fix the plan. |
| Prioritized findings | See the vulnerabilities and misconfigurations that the plan ranks highest. |
| Saved plans | Open the Risk Workbench tab to see all your saved plans in one list. |
ETM calculates the projected score in the background. This takes about 2–3 minutes. Until it is done, you see an information message on the plan.
Not sure where to start? Use Highest Risk Reduction. It picks the findings that lower your risk the most, with no setup.
Filter Risk
Filters help you focus on the findings that matter to you. To use your own filters, click Let Me Decide, then drag and drop filters from three groups:
| Filter group | Applies to |
|---|---|
| Common Attributes | Both vulnerabilities and misconfigurations |
| Vulnerabilities | Vulnerabilities only |
| Misconfigurations | Misconfigurations only |
Ask yourself a question, then pick filters that answer it. For example:
| If you want to know… | Filter by |
|---|---|
| Which of my highest-risk assets need attention? | A high TruRisk score range |
| What is wrong on the assets my business depends on? | A high Asset Criticality Score (ACS) |
| Should I look at vulnerabilities or misconfigurations first? | Finding type |
Found filters that work for you? Click Save as Template. Your template then appears on the Select Prioritization Approach page, ready to reuse.
Group Risk
Grouping turns a long, flat list into a few clear buckets. Use Group By above the findings list to put findings that share a value together.
- REVIEWGroup by severity: See how your findings split across Critical, High, and Medium, and start at the top.
- REVIEWGroup by vulnerability: See every finding for the same vulnerability together. One fix can often close many findings at once.
After you group, click a count to see the findings or assets in that group.
Investigate Risk Factors
A high score tells you that a finding is risky. Risk factors tell you why. To see them, click a finding and select View Details from the Quick Actions menu. Look for these signals:
| Signal | What it tells you |
|---|---|
| Exploitability | Whether anyone is using it. Actively Exploited means attacks in the past 30 days. |
| Threat signals | Signals such as a public exploit, known threat actors or malware, and the EPSS score. |
| Your impact | How many assets are affected, and how many of them face the internet. |
Act on What You Find
Select one or more findings, and use the Actions or Quick Actions menu:
| If you find that | Use this action |
|---|---|
| You are not sure the finding can really be exploited | Launch TruConfirm Assessment |
| The finding is not valid | Mark False Positive |
| Your business accepts the risk | Accept Risk |
| You need to attach proof or notes | Add Supporting Artifacts |
A medium-severity finding that is actively exploited on an internet-facing asset can be more urgent than a critical finding on an isolated asset. Let the risk factors, not only the score, set your order.
Export Results
Share your plan with your team, your manager, or your auditors. To download the prioritization report, click the menu icon (☰) on the plan.
The report includes:
- Plan title and description
- Scope and applied filters
- CVSS details
- Vulnerability count
- Impacted findings
- Asset details and asset IDs
Export the CSV copy of the report when you create a plan. It helps you track which findings were selected for remediation and why.
Next: Prioritization Workflow. Create your first prioritization plan, step by step.