Contextual risk scoring

A raw severity scale treats every “high” the same. CloudVision360 scores findings from severity plus your business context, so the list reflects real risk to your organization.

What goes into a score

• Severity of the underlying issue.
• Exposure — is the resource reachable from the internet?
• Data classification — does it hold or reach sensitive data?
• Environment and criticality — production versus sandbox, read from your tags.

The same misconfiguration scores higher on an internet-facing production database than on an isolated test resource.

Tune the model

Open Admin → Settings → Risk model (the gear at the bottom of the rail) to adjust how much each factor weighs, so the score matches how your organization thinks about risk. Changes are versioned and recorded in the audit trail.

Compensating controls

A risk exception with a compensating control lowers a finding’s score for the life of the exception; when the exception expires, the score returns.

Where the score is used

The score drives the Fix first order, the approval path for remediation, and the SLA each finding is held to.