SecurityAssess & Improve SecurityInitiatives
How the Space Risk Score Is Calculated
The Space Risk Score is a single 0-100 metric that summarizes the security risk for a space. Higher means more risk; 0 means no risk. It's the score that the Risk Reduction value of each Initiative directly improves.
Use it as a high-level benchmark to track your security posture over time.
The formula
The Space Risk Score is the average asset risk score across every asset in the space:
Space Risk Score = (sum of all asset risk scores) ÷ (total number of assets)
Where:
- Asset risk score is the 0-100 score Mondoo assigns each asset, rolled up from all of that asset's findings and weighted by impact. See Asset and Space Risk Scores.
- Sum and total number cover every asset in the space.
How exceptions are handled
Exceptions change an asset's risk score, which then flows into the space average. They never change the number of assets counted.
| Exception type | Effect on the score |
|---|---|
| Risk Accepted, False Positive, Workaround | The finding contributes 0 to its asset's risk score. |
| Disable | The check stops running and is excluded from its asset's score. |
Example
A space has 3 assets:
| Asset | Asset risk score | Notes |
|---|---|---|
| web-server-01 | 95 | |
| db-server-02 | 80 | |
| build-agent-03 | 0 | No findings affect its score |
Calculation:
- Sum:
95 + 80 + 0 = 175 - Space Risk Score:
175 ÷ 3 = 58.33