Risk across endpoints

How an asset's score on each endpoint becomes one company-wide score, how endpoints and the organization get a level, and the exact formula.

The scanner scores each asset on each endpoint separately. The console then combines those instances into the numbers you see on Inventory, Endpoints, and Insights. This page explains that combining step. For how a single score is built, see How risk is calculated.

From one endpoint to the company

The scanner scores each asset on each endpoint separately, because the same asset can be set up safely on one endpoint and badly on another. The console then combines the instances.

Only endpoints active in the last 7 days count. Instances with an Unknown risk level are left out. If none of an asset’s instances has been assessed, the asset is Unknown.

An endpoint’s own score is the average of its assessed assets’ scores, and its level follows from that score. An endpoint with no assessed assets shows no score.

The Insights governance numbers count each asset once, however many endpoints it is on.

The formula

For readers who want the exact math.

I = policy score / 10, for each failed policy
G = the highest I among failed policies about the same problem
L = 1.00 × G1 + 0.60 × G2 + 0.30 × G3 + 0.10 × (G4 + G5 + ...)   with G1 ≥ G2 ≥ G3 ≥ ...
score = 10 × (1 − e^(−L))

For the example above: L = 1.00 × 0.90 + 0.60 × 0.70 = 1.32, and 10 × (1 − e^(−1.32)) ≈ 7.3.

Next steps

• How risk is calculated for where a single score comes from
• Insights for the company-wide view these numbers feed