Risks in the Supplier Risk Module

In the Platform Supplier Risk module, risk instances are vulnerabilities, exposures, and misconfigurations that have been identified on assets. Each risk instance has a detailed description, confidence level, evidence from Censys scans, and affected services.

Use risk information to pursue remediation efforts with your suppliers and update your own organization's defensive posture.

Risk categories

Risk data

In the Platform UI, each risk instance has a score, description, confidence level, evidence from Censys scans, and affected services (on hosts). This information is shown on risk cards on assets, on risk entries in the Risks tab, and on action items.

Discovery paths for the asset associated with a risk instance are shown on risk instances on the Risks tab.

Risk data can also be retrieved via the list risk instances and list risk events API endpoints.

Risk instance scores

Risk instance scores are Censys-derived metrics that incorporate asset importance, risk severity, exploitation status, and threat intelligence. Scores help you understand the severity of a risk instance using comprehensive asset and vulnerability context so you can effectively determine its remediation priority.

Risk instance score formula

Scores are determined using the following formula:

((Asset attributes + risk severity + exploitation status)/number of metrics) + additive threat variable) * 10

The resulting risk score is rounded to the nearest tenth. The highest a score can be is 10. Score range severities are shown in the table below.

Asset attributes

This value defines how important an asset is to an organization. Important assets are more appealing targets to an attacker and compromising a more important asset will have greater impact on your organization. Asset importance categories and their values are shown in the table below.

The asset’s importance value is based on Censys-applied labels. The maximum value of any labels present on the asset is used for scoring purposes. For example, if an asset has two labels with the Important value and one label with the Essential value, the value used in the formula is 1.

If no labels or no mapped labels are present on an asset, then asset attributes are not factored into the final risk score.

Asset importance mapping

The following table explains which Censys labels map to asset importance levels.

Risk severity

The risk severity value is either applied by Censys for Censys-developed risks or derived from CVSS score for CVEs. For CVEs, the severity value is the CVSS value divided by 10.

Severity is always present on risks and is always used in score calculation.

Exploitation status

Exploitation status is always used in score calculation. For CVEs, exploitability is defined based on the following:

For exposures and misconfigurations, Censys applies a set exploitation status based on extensive research.

Additive threat variable

The additive threat variable is based on whether known threat actors are associated with particular risk. Its presence or absence does not contribute to the "number of variables" value in the score calculation.

Number of variables

The number of variables depends on the count of the asset attribute, risk severity, and exploitation status values used for the formula. If asset attributes are not present, then the number of variables is 2. If asset attributes are present, then the number of variables is 3.

Example risk scores

The following table shows the calculation for an asset with the LOGIN_PAGE label that is affected by CVE-2020-11984.

The following table shows the calculation for an asset with no mapped labels with an exposed FTP service.