Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Risk scoring

Everything Mesh assesses — identities, entities, and non-human assets — carries a risk score. The score is Mesh's answer to a single question: if this thing were compromised, how exposed would your organization be? This page explains what the score means, what goes into it, and how to read it wherever it appears.

The scale​

Risk scores range from 1 to 100, with 1 being the least risky and 100 the most. Individual scores roll up into higher-level scores: identity scores contribute to the entities those identities belong to, and entity scores roll up into your organization's overall risk score on the dashboard.

A score is not a grade you set — Mesh recalculates it as connectors collect new data, so remediating a risk lowers the score on a later collection cycle.

Severity​

Alongside the number, Mesh conveys severity so you can triage without memorizing thresholds:

  • Risk signals are ranked — low, moderate, high, critical — so the most important items surface first.
  • In lists and detail views, the color of the score conveys its severity band, and severity labels such as "Low Risk" or "Critical Risk" appear where you point to a score.

The same score means the same thing everywhere: a tooltip on a list row and the one on the corresponding details page break the score down identically.

What goes into a score​

Mesh doesn't score anything in isolation. It first correlates accounts, credentials, entitlements, and activity from every connected source into identities, then runs risk engines against the correlated data. Each engine emits signals with a severity — conditions such as excessive access, stale accounts, weak authentication, or known breach exposure — and those signals combine into the score.

Because the inputs are correlated, a score reflects more than the object itself. An identity that signs in with a strong authenticator in one system but only a password in another is scored on the weaker path, because that is the path an attacker would take. The more sources you connect, the more complete the correlation and the more accurate the score.

Direct and inherited risk​

A score combines two kinds of risk:

  • Direct risks — conditions found on the object itself. For an asset, that might be "No owner"; for an identity, an inconsistent account status.
  • Inherited risks — risks carried over from correlated objects. An asset inherits risk from the assets correlated to it, and an entity is threatened by the risk of the identities and entities that overlap with it. This is how Mesh expresses blast radius: a breach in one place splashes onto everything correlated with it.

On an asset, the risk score tooltip makes this split explicit — it lists the direct risk categories on the asset with their counts, followed by a summary of the risks inherited from its correlated assets.

Risk tags​

Risk tags label the individual risks that contribute to a score, so you can see not just how risky something is but why. Examples include PQC noncompliant, No owner, No linked asset, and Insufficient information. Tags come in two forms:

  • Simple risks state a condition plainly — for example, "This asset has no assigned owner."
  • Policy-based risks show the outcome of a policy assessment — for example, noncompliance with a post-quantum cryptography (PQC) policy — along with the attributes that didn't comply and the policy that triggered the tag.

The exact set of tags depends on the risk conditions Mesh detects and the risk policies configured for your organization. For how tags appear on non-human assets, see the PQC dashboard.

From scores to loss estimates​

The 1–100 score ranks risk; it doesn't put a currency figure on it. For quantitative analysis, Mesh generates FAIR (Factor Analysis of Information Risk) reports based on Open FAIR v3.0 terminology:

  • Loss Magnitude (LM) — the size of the loss if a loss event occurs.
  • Loss Event Frequency (LEF) — how often a loss event is expected to occur.
  • Annualized Loss Expectancy (ALE) — the resulting yearly loss estimate, with risk-factor breakdowns.

See Reports, exports, and data retrieval for what a FAIR report contains and how the model counts losses and identities.

In the Generative UI, the same FAIR data appears as live workspace widgets — a headline annual-loss figure, the loss distribution, a breakdown of where the loss comes from, the reduction your remediation has delivered, and a quarterly trend — most visibly on the Executive View. Putting risk in dollars is the heart of the Quantify risk in dollars use case.

Where scores appear​

  • Dashboard — your organization's overall risk score widget, and the bubble chart where each entity is sized and colored by risk.
  • Entity details — the entity's score, its main risks, and the overlapping entities that share its blast radius.
  • Identities & risks table — every identity in the selected entities, ranked by score, with risk labels.
  • Identity details — the identity's score, its main risks, and the accounts contributing to it.
  • Asset lists and asset details — machine, software, and crypto assets on the PQC dashboard, each with a score and its breakdown tooltip.

Scores surface the same way in Generative UI workspaces: widgets such as risk gauges and trend views render the same scores as the classic dashboards, from the same data.

Making scores more accurate​

Scores are only as good as the correlations behind them. Profiling gaps — unconfirmed account associations — can leave a score incomplete. Resolving them, or delegating them to someone who can, gives your organization a more accurate score. See Identities for how to review and resolve profiling gaps.

  • Identities — how accounts correlate into identities.
  • Entities — how identities group into entities and how risk overlaps between them.
  • Delegation — assigning a risk to the right person to remediate.
  • Your first dashboard view — a walkthrough of where risk surfaces in the dashboard.