TruRisk concepts
TruRisk is the core scoring and quantification model that powers Enterprise TruRisk Management (ETM). It transforms technical vulnerability and configuration data into business-aligned, actionable risk metrics.
Key TruRisk Concepts
- Risk: The measurable potential impact that vulnerabilities, misconfigurations, and security threats pose to your organization's infrastructure, data, and business operations.
- TruRisk: A risk-based approach to assessing and contextualizing cybersecurity risk by considering relevant security findings, asset information, and business context.
- Risk Factors: The attributes and conditions that contribute to an asset's or environment's overall risk, such as vulnerabilities, asset criticality, threat exposure, and business context.
- TruRisk Score: A numerical score from 0 to 1,000 assigned to each asset, and aggregated for business entities and the organization, based on multiple contributing factors, including asset criticality, vulnerability severity, and detected threats. The score helps organizations focus remediation efforts on assets that pose the greatest risk.
- Asset Criticality Score (ACS): A value from 1 to 5 that indicates the business criticality of an asset. ACS is derived from the criticality of the tags assigned to the asset or from an AI-recommended value. If no criticality is available, a default value of 2 is used. When multiple tags with criticality are assigned to an asset, the highest criticality score is used in the TruRisk calculation. This factor prioritizes assets that are most critical to business operations.
- Qualys Detection Score (QDS): A normalized severity metric (scale 1–100) that ranks vulnerabilities based on technical details, threat intelligence, and exploit availability. QDS integrates CVSS scores, EPSS data, CISA KEV, exploit code maturity, malware associations, active threat actors, and trending threats.
- Qualys Vulnerability Scoring System (QVSS): A Qualys-assigned score from 0 to 10 for vulnerabilities, derived from multiple factors, including CVSS, external threat indicators, active exploitation status, and exploit code maturity. QVSS applies to all vulnerabilities, including those without Qualys detection signatures.
How TruRisk Is Calculated
TruRisk provides an assessment of risk by analyzing findings and asset criticality. ETM uses the Qualys Detection Score (QDS) assigned to findings and the Asset Criticality Score (ACS) assigned to assets to calculate the TruRisk Score. The calculated risk is aggregated to provide insights into business entities and the organization's overall risk posture.
For detailed information about the TruRisk calculation, including formulas and score ranges, see TruRisk™ Score for Assets.
Risk Factors
Risk factors represent the conditions and attributes that contribute to the risk associated with an asset or finding. In Enterprise TruRisk Management (ETM), risk factors help identify the security and business conditions that may increase the likelihood or potential impact of a security threat.
ETM provides risk factor insights to help you understand the primary contributors to an asset's TruRisk Score and prioritize remediation based on the severity and context of the identified risks.
You can also configure custom risk factors to adjust TruRisk Scores based on organization-specific criteria, such as asset exposure, business requirements, and security conditions. Compensatory factors can be used to account for security controls that reduce exposure.
For more information, see TruRisk Customization Using Risk and Compensatory Factors.
Risk Score Interpretation
The TruRisk Score provides an assessment of the risk associated with an asset or business entity. It helps you understand the relative level of risk in your environment and identify assets or business entities that require further investigation or remediation.
ETM presents TruRisk Scores along with relevant business context and contributing risk factors to support risk assessment and prioritization. Reviewing the score and its contributing factors helps you understand the conditions that influence risk and determine appropriate remediation priorities.
The TruRisk Score ranges from 0 to 1,000. The interpretation of the score should be based on the applicable scoring model, risk context, and configured risk appetite.
For more information, see View TruRisk Summary and TruRisk™ Score for Assets.