Risk inputs
Risk inputs are the data elements that Qualys Enterprise TruRisk Management (ETM) uses to assess and quantify cyber risk. ETM collects risk-related information from connected data sources and evaluates these inputs to calculate the TruRisk Score for assets.
No single risk input provides a complete representation of an asset's risk. For example, a vulnerability with a high severity rating may have limited immediate risk if it is not exploitable or has no known active exploitation. Conversely, a vulnerability with a moderate severity rating may pose a significant risk when it affects a business-critical asset and is actively exploited.
ETM combines multiple risk inputs to provide a more comprehensive assessment of risk, considering both the likelihood of exploitation and the potential impact on the organization.
Risk Inputs Used by ETM
ETM evaluates the following primary risk inputs:
| Risk input | Description |
|---|---|
| Asset criticality | Indicates the importance of an asset to the organization and the potential business impact of its compromise. |
| Vulnerability severity | Indicates the potential technical impact of a vulnerability if exploited. |
| Exploitability | Indicates how easily a vulnerability can be exploited by an attacker. |
| Threat intelligence | Provides information about active exploitation, known threats, and attacker activity associated with vulnerabilities. |
| Business context | Provides information about the business role, data, and organizational importance of an asset. |
Each input provides a different perspective on risk. When evaluated together, these inputs help ETM assess the likelihood of a successful attack and the potential consequences of a compromise.
Asset Criticality
Asset criticality indicates the importance of an asset to your organization and the potential impact of its compromise on business operations.
For example, a production database that stores customer records may be more critical to the organization than a test workstation, even when both assets have the same vulnerability.
ETM assigns each asset an Asset Criticality Score (ACS) on a scale of 1 to 5, where 5 represents the highest criticality. ACS is derived from the criticality of the tags assigned to the asset or from an AI-recommended value. If no criticality is available, a default value of 2 is used.
Asset criticality helps ETM account for the business importance of an asset when assessing its overall risk.
For more information, see Assets.
Vulnerability Severity
Vulnerability severity indicates the potential technical impact of a vulnerability when it is successfully exploited.
ETM evaluates vulnerability severity using information from industry standards, such as the Common Vulnerability Scoring System (CVSS), and Qualys severity ratings.
Severity describes the potential technical consequences of a vulnerability, such as unauthorized access, data exposure, or disruption of services. However, severity alone does not indicate whether a vulnerability is currently being exploited or how likely an attack is to succeed.
ETM evaluates exploitability and threat intelligence alongside vulnerability severity to provide additional context for risk assessment.
For more information, see Findings.
Exploitability
Exploitability indicates how easily an attacker can take advantage of a vulnerability. It provides context about the likelihood that a vulnerability can be successfully exploited in a real-world attack.
ETM considers exploit-related factors, which may include the following:
- Availability of a public exploit or proof-of-concept code.
- Whether the exploit is weaponized or incorporated into exploit kits.
- Whether the vulnerability can be exploited remotely.
- Whether exploitation requires authentication or user interaction.
A vulnerability with a publicly available, working exploit may present a more immediate security concern than a vulnerability for which exploitation has not been demonstrated. The actual risk also depends on factors such as asset exposure, security controls, and business context.
Exploitability complements vulnerability severity by providing information about the feasibility of an attack.
Threat Intelligence
Threat intelligence provides information about observed or documented attacker activity, emerging threats, and exploitation trends. ETM uses threat intelligence to identify vulnerabilities associated with active exploitation, malware, ransomware, or known threat actors.
Relevant threat intelligence may include information from sources such as:
- Qualys Threat Research Unit.
- CISA Known Exploited Vulnerabilities (KEV) catalog.
Threat intelligence helps distinguish vulnerabilities that present an active or demonstrated threat from those for which there is no corresponding evidence of exploitation. This information supports risk prioritization by providing context about the current threat landscape.
For more information, see Threat Intelligence.
Business Context
Business context describes how an asset supports your organization's operations and the potential business consequences of its compromise.
Business context may include information such as:
- Business entity to which the asset belongs.
- Application or service supported by the asset.
- Data processed or stored by the asset.
- Regulatory or compliance requirements associated with the asset.
For example, a vulnerable server supporting a revenue-generating application may have greater business implications than an isolated server with a similar finding. Business context helps ETM account for these differences when evaluating risk.
By incorporating business-related information, ETM provides a risk assessment that considers more than the technical characteristics of individual vulnerabilities.
For more information, see Business Context.
How ETM Combines Risk Inputs
ETM evaluates risk inputs through a multi-level assessment process. Vulnerability-related inputs, including severity, exploitability, and threat intelligence, contribute to the Qualys Detection Score (QDS) for each finding. ETM then uses finding-level risk information, together with asset criticality and relevant business context, to assess asset risk and calculate the TruRisk Score.