Configure Risk Categories

Risk categories (also called risk dimensions) are how Mondoo adjusts each finding's risk score based on the context of the asset it appears on. Out of the box, all five categories are enabled with default weights. You tune them at the organization level on the Risk Score Control page; every space in the organization inherits the configuration.

The five categories are Business Priority, Attack Surface, Exploitability, Blast Radius, and In the News. For each one you can:

• Turn it off. Clear Score this category to remove its effect entirely. Findings are scored as if the category doesn't exist.

• Adjust its weight. Use the Factor score weighting slider to make the category count more or less toward the final score.

• Tune what's inside it. Each category has its own settings:

  Category	What you can tune
  Business Priority	Tag Groups: named groups of asset tags (key-value pairs), each with an Asset score impact from No severity to Most severe. The defaults are Business-critical, Test environments, and Development systems. You can add your own groups.
  Attack Surface	Exposure Level: how much each level (Internet-facing, Network-accessible, Localhost only, System-local, Not exposed) raises or lowers the score.
  Exploitability	Scoring Factors: turn EPSS and KEVs on or off and set how strongly each one influences the score.
  Blast Radius	Connected System Types: how much access to databases and data stores, identity and auth systems, LLM agents, open network connections, Kubernetes orchestration, or cryptographic keys raises the score.
  In the News	Turn news articles and social media on or off as signals and set how strongly each one influences the score.

Open Risk Score ControlCopy Anchor Link

1. In the Mondoo App, navigate to the organization.

2. In the side navigation, expand Security Model and select Risk Score Control.

   

   A CUSTOMIZED badge marks categories whose settings differ from the defaults. A DISABLED badge marks categories that are turned off.

3. Select EDIT on a category to turn it on or off, change its weight, or tune its settings. Select DONE to collapse it.

4. Select SAVE to apply your changes to every space in the organization.

To undo customizations, select RESET SECTION TO DEFAULTS inside a category, or RESET ALL at the top of the page to restore every category. A reset takes effect when you save.

When to tuneCopy Anchor Link

Some examples of when tuning makes sense:

• Your team doesn't track press coverage as a security signal. Turn off the In the News category so trending CVEs don't get an automatic boost.

• You consider blast radius the dominant factor. Raise the Blast Radius weight so findings on assets with access to databases and identity systems rise to the top of the list.

• You use your own tag scheme for business priority. Add a tag group (such as one matching tier: gold or criticality: high) and set its asset score impact so the Business Priority category picks those assets up alongside the defaults.

Override risk categories per assetCopy Anchor Link

To correct Mondoo's automatic detection on individual assets or spaces, use annotations. See Override automatic detection.

See alsoCopy Anchor Link

• Risk Dimensions
• How Mondoo Scores and Prioritizes Findings