CVSS tells you how bad a flaw could be. AssurIQ Risk tells you what to fix first.
Vulnerabilities, misconfigurations, identity weaknesses and exposed services are scored together, in context: what the asset is, where it sits on the map, whether the flaw is being exploited, and which controls and frameworks it drags down.
- CVSS base9.8
- EPSS0.94
- Known exploited (KEV)Yes
- ExposureInternet-facing
- Asset criticalityEdge firewall
- Compensating controlNone
- Age11 days
- 3 controls affected — AIQ-NET-011, AIQ-VUL-001, AIQ-NET-014 move to FAIL
- Frameworks — FTC Safeguards, NIST CSF 2.0, Cyber Insurance Baseline
- Blast radius — every VLAN behind the edge, incl. F&I workstations
- Remediation — firmware update queued · validation rescan on completion
Seven factors, one explainable score.
Every risk score shows its inputs. Technicians can see why a medium CVE on an exposed dealership firewall outranks a critical one on an isolated print server.
CVSS base score as the starting point — an input, never the verdict.
EPSS probability of exploitation in the wild within 30 days.
Listed in CISA KEV or observed exploited: immediate weight.
Internet-facing, reachable from guest / IoT segments, or isolated — derived from the live topology.
Edge firewall, domain controller, F&I workstation, lab box — set per asset or inherited from role.
Compensating controls that genuinely reduce reachability lower the score and are recorded as evidence.
Open time increases weight; nobody should be surprised by a six-month-old critical.
Risk from every layer of the environment.
Vulnerability intelligence
Configuration risk
External attack surface
Identity & AD posture
Connected impact
Lifecycle & end-of-life
Where a device sits changes what its vulnerabilities mean.
Scanners without topology treat every host equally. AssurIQ knows the firewall is the edge, the camera is on the wrong VLAN, and the finance workstation is two hops from both.
- Internet-facing versus internal versus isolated, derived from the live map
- Reachability from guest and IoT segments counted as exposure
- Blast radius: what is behind the affected device
The most common critical finding is an admin without MFA.
Identity findings flow through the same risk model, the same controls and the same remediation queue as network findings — because attackers do not care which team owns the gap.
- Privileged Microsoft 365 / Entra ID and AD accounts inventoried and scored
- Findings link to the MFA and credential-hygiene controls they break
- Remediation validated by re-reading the identity provider, not a checkbox
- svc-backup@brightpathGlobal AdminNo MFA
- j.reyes@brightpathGlobal AdminMFA enforced
- legacy-scanDomain Admin (AD)Password 412d old
- kiosk-frontdeskUserLegacy auth allowed
Security Risk is not Assurance, and neither is Operational Health.
A customer can be low-risk and poorly proven, or well-documented and badly exposed. AssurIQ reports the three scores side by side so leadership sees both the exposure and the evidence picture honestly.
From technical findings to business risks — and back.
Findings roll up into a Risk Register with owners, treatment decisions and review dates. Every register entry links back to the assets, findings and controls that justify it, which is the risk-analysis foundation HIPAA and FTC Safeguards both expect.
- Accept, mitigate, transfer or avoid — recorded with rationale
- Review dates and owners with overdue tracking
- Linked findings and controls keep the register current
- Exported into executive and assessor reports
Common questions about risk scoring
Is AssurIQ Risk the same as CVSS?+
Can we tune criticality and mitigations?+
Does a high Risk score mean we are non-compliant?+
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.