Risk score
Each asset with a completed assessment has a risk score that summarizes its current open findings as a single number. You can view the score on the asset’s page to help you prioritize remediation work.
The score is a relative signal for triage, not a calibrated measure of business risk. To better understand the score, review the findings behind it.
How the risk score is calculated
The risk score is a count of an asset’s open findings, weighted by severity:
Risk score = (4 × critical) + (3 × high) + (2 × medium) + (1 × low)
Each open finding adds its severity weight to the total. Informational findings have a weight of 0, so they never change the score.
Findings are removed from the total score when you mark them as fixed or intended, or when XBOW retests and confirms a fix. The score therefore reflects your current exposure rather than the original assessment findings.
How severity is set
A finding’s severity comes from its CVSS score, using the standard qualitative ratings defined by FIRST. XBOW shows FIRST’s None rating (0.0) as Informational:
| CVSS score | Severity |
|---|---|
| 9.0–10.0 | Critical |
| 7.0–8.9 | High |
| 4.0–6.9 | Medium |
| 0.1–3.9 | Low |
| 0.0 | Informational |
For more about CVSS, see the CVSS v3.1 specification from FIRST. For the vulnerability classes XBOW reports and how they map to CWEs, see Vulnerability classification.
Score bands and color indicators
XBOW color-codes the score into bands so you can gauge an asset’s risk at a glance:
| Score | Band | Color |
|---|---|---|
| 0–9 | Low | Green |
| 10–49 | Medium | Orange |
| 50+ | High | Red |