How Risk Reduction Is Calculated
Risk reduction is the number of points your Space Risk Score drops when an initiative is complete on every asset it affects. Mondoo ranks your initiatives by this number, so the initiative at the top of the list removes the most risk.
Because the Space Risk Score is an average over every asset in the space, the calculation has two steps.
Step 1: Total the improvement on each affected asset
For each asset in the initiative, Mondoo estimates how much the asset's risk score drops once the initiative's software updates are applied. The improvement depends on how risky the vulnerabilities being fixed are compared with whatever risk remains on the asset afterward. Then Mondoo adds up the improvements across every affected asset.
Example. An initiative updates the same package on three assets:
| Asset | Improvement to the asset risk score |
|---|---|
| A | 45 |
| B | 40 |
| C | 45 |
Total improvement: 45 + 40 + 45 = 130 points.
Step 2: Divide by the total assets in the space
The Space Risk Score averages risk over every asset in the space, including assets the initiative doesn't touch. To express the improvement as a change to that average, Mondoo divides by the total number of assets in the space:
Risk reduction = (total improvement across affected assets) ÷ (total assets in the space)
Continuing the example. If the space has 295 assets:
- Risk reduction:
130 ÷ 295 = 0.44
Completing the initiative lowers the Space Risk Score by about 0.44 points. The Initiatives list shows risk reduction to two decimal places; the initiative detail page rounds it to one.
When you view a workspace, Mondoo uses the same calculation with the workspace's assets, so the numbers show the effect on the Workspace Risk score.