SecurityAssess & Improve Security

Asset and Space Risk Scores

How Mondoo rolls up individual finding scores into asset risk scores and space risk scores.

Mondoo gives you a 0-100 risk score at every level of your infrastructure. Every level uses the same scale: higher means more risk; 0 means no risk.

ScoreWhat it measuresWhere to find it
Finding risk scoreOne issue on one assetFindings
Asset risk scoreAll findings on one asset, weighted by impactAsset detail page
Space Risk ScoreAll findings across every asset in the spaceSpace dashboard and Top Actions

How asset scores are calculated

When Mondoo scans an asset, it evaluates the asset against every enabled policy that applies (Linux policies for Linux assets, AWS policies for AWS accounts, and so on). The asset score is the weighted percentage of policy checks the asset failed, with each check weighted by its impact (Critical, High, Medium, Low).

The score is further adjusted by five risk dimensions that account for the real-world context of each asset: attack surface, blast radius, business priority, exploitability, and news.

You can change how Mondoo combines check results into an asset score by changing the scoring system used by a policy in your space.

Severity bands

Asset risk scores map to the same severity bands as individual findings:

Score rangeSeverity
90–100Critical
70–89High
40–69Medium
1–39Low
0None

How the Space Risk Score is calculated

Asset risk scores roll up into the Space Risk Score: the average risk across every finding in the space. The Space Risk Score is what your Top Actions list directly improves.

To learn the exact formula and how exceptions are handled, read How the Space Risk Score Is Calculated.

On this page