Once you have all your data in one place, the next step is to prioritize vulnerabilities that pose the greatest risk to your organization. The Cisco Security Risk Score (formerly Kenna Risk Score) in Cisco Vulnerability Management is assigned to every CVE, CWE, and WASC in your environment.<\/p>\n

Leveraging ground truth telemetry and an extensive amount of internal security data, the Cisco Security Risk Score ties into Cisco Vulnerability Management\u2019s predictive model to algorithmically determine risk scores for each unique vulnerability, ranging from zero (no risk) to 100 (highest risk). And, in concert with asset criticality scores, Cisco Vulnerability Management determines an actionable risk score for each asset and group of assets that ranges from zero (no risk) to 1000 (highest risk).<\/p>\n

The Cisco Security Risk Score takes into account all of the internal and external variables used in the predictive model that are high indicators of risk. Internal risk calculations factor in the number of instances of each vulnerability in your environment, their potential severity, and the criticality of the assets threatened by each vulnerability. External risk calculations factor in more than just the CVSS score of the vulnerability by also including EPSS, threat intelligence information such as whether or not an exploit kit is available for the vulnerability, the volume and velocity of exploits that take advantage of the vulnerability, and the prevalence of the vulnerability seen throughout customer environments. With accurate and quantifiable risk scores, you will understand your organizations\u2019 current risk posture and identify the actions you can take to reduce the greatest amount of risk.<\/p>\n