Understanding AssurIQ Risk (CVSS vs AssurIQ Risk)
Why CVSS alone is not risk, and how AssurIQ combines severity, EPSS, KEV, exposure, criticality, mitigations and age.
- A vulnerability scan has completed for at least one asset
- Familiarity with basic CVSS terminology is helpful but not required
Overview
CVSS scores describe how severe a vulnerability could theoretically be if exploited under worst-case conditions. It says nothing about whether that vulnerability is actually being exploited, whether the affected asset is reachable from the internet, or how much damage a successful exploit would actually cause in your environment. AssurIQ Risk answers those questions directly instead of leaving them to a static severity number.
How is this calculated?
AssurIQ Risk is a 0-100 score computed per finding from seven weighted factors. Each factor is evaluated with current data, not a value fixed at disclosure time, so the score moves as real-world conditions change.
| Factor | What it measures | Why it matters |
|---|---|---|
| Severity (CVSS) | Technical severity of the vulnerability itself | Baseline signal for potential impact |
| EPSS | Probability of exploitation in the next 30 days | Distinguishes theoretical risk from active threat |
| KEV | Whether CISA has confirmed real-world exploitation | The strongest available signal that exploitation is not hypothetical |
| Exposure | Whether the asset is internet-facing, internally exposed, or isolated | An unreachable asset cannot be remotely exploited |
| Asset criticality | Business importance of the affected asset | The same flaw on a domain controller outweighs the same flaw on a print server |
| Mitigations | Compensating controls already in place (WAF, segmentation, MFA, EDR) | Reduces effective risk even before the underlying flaw is patched |
| Age | How long the finding has been open | Unremediated findings accumulate risk the longer they persist |
Worked example: high risk
Summit Ridge Auto Group's edge firewall, sr-ford-fw01, has an SSL-VPN vulnerability rated CVSS 9.8 with an EPSS score of 0.94 (94% probability of exploitation within 30 days) and a confirmed CISA KEV listing. The device is internet-facing and classified as a critical asset because it is the perimeter control for the entire dealership network.
- CVSS
- 9.8 (Critical)
- EPSS
- 0.94
- KEV
- Yes — confirmed exploited
- Exposure
- Internet-facing
- Asset criticality
- Critical
- Mitigations
- None applied
- AssurIQ Risk
- 96
Worked example: low risk despite similar severity
By contrast, an internal file server with a similarly high CVSS finding, no confirmed exploitation, no KEV listing, and no direct internet exposure — sitting behind network segmentation and covered by endpoint detection — scores approximately 40, in the moderate range rather than critical.
- CVSS
- 9.1 (Critical)
- EPSS
- 0.06
- KEV
- No
- Exposure
- Internal only, segmented VLAN
- Asset criticality
- Standard
- Mitigations
- EDR present, network segmentation
- AssurIQ Risk
- ~40
Risk bands
| Band | Score range | Typical response |
|---|---|---|
| Critical | 85-100 | Remediate immediately, treat as an incident if internet-facing |
| High | 65-84 | Remediate within the standard SLA window |
| Moderate | 35-64 | Schedule into the next patch cycle |
| Low | 0-34 | Track and reassess; no immediate action required |
How mitigations reduce risk
AssurIQ Risk gives credit for compensating controls that are actually in place and evidenced, not assumed. A finding behind a validated WAF rule, network segmentation, endpoint detection, or an MFA requirement scores lower than the identical finding with no compensating control, because the practical likelihood of successful exploitation is genuinely lower.