Asset and Space Risk Scores
How Mondoo rolls up individual finding scores into asset risk scores and space risk scores.
Mondoo gives you a 0-100 risk score at every level of your infrastructure. Every level uses the same scale: higher means more risk; 0 means no risk.
| Score | What it measures | Where to find it |
|---|---|---|
| Finding risk score | One issue on one asset | Findings |
| Asset risk score | All findings on one asset, weighted by impact | Asset detail page |
| Space Risk Score | Average risk across every asset in the space | Space dashboard and Initiatives |
How asset scores are calculated
An asset's risk score combines two kinds of findings:
-
Misconfigurations. When Mondoo scans an asset, it evaluates the asset against every enabled policy that applies (Linux policies for Linux assets, AWS policies for AWS accounts, and so on). Failed checks count toward the score according to their impact (Critical, High, Medium, Low). You can change how Mondoo combines check results by changing the scoring system used by a policy in your space.
-
Vulnerabilities. Known vulnerabilities (CVEs) and vendor advisories in the asset's software. The riskiest one sets the vulnerability part of the score.
When an asset has both, its risk score is the average of the two parts. When it has only one kind (for example, a cloud account with policy results but no installed software), that part is the asset's risk score.
Each finding's contribution is adjusted by five risk categories that account for the real-world context of the asset: business priority, attack surface, exploitability, blast radius, and in the news.
Severity bands
Asset risk scores map to the same severity bands as individual findings:
| Score range | Severity |
|---|---|
| 90–100 | Critical |
| 70–89 | High |
| 40–69 | Medium |
| 1–39 | Low |
| 0 | None |
How the Space Risk Score is calculated
Asset risk scores roll up into the Space Risk Score: the average asset risk score across every asset in the space. The Space Risk Score is what your Initiatives list directly improves.
To learn the exact formula and how exceptions are handled, read How the Space Risk Score Is Calculated.