Risk Score
Release status
Risk Score is currently in Early Access for Snyk Open Source and Snyk Container. Use Snyk Preview to replace the Priority Score with the new Risk Score for Snyk Open Source and Snyk Container issues.
The Snyk Risk Score is a single value assigned to an issue, applied by automatic risk analysis for all vulnerability-type issues. License issues are not currently supported. Risk Score is based on the potential impact and likelihood of exploitability. Ranging from 0 to 1,000, the score represents the risk imposed on your environment and enables a risk-based prioritization approach.
Risk score remains the same over time if the contributing factors do not change. However, some contributing factors, such as Exploit Prediction Scoring System (EPSS), potentially can change frequently. The number of days since the vulnerability was first published is also a factor and causes the score to change once, when the number of days becomes more than one year and the likelihood subscore decreases.
Since real risk is scarce, you should expect a significant drift in the distribution of scores, as can be seen in this example of Project score distributions:
Risk Score replaces the Priority Score directly. See the priority score docs for how to interact with the Risk Score in the UI, API, and Reports, where the Risk Score is now introduced when enabled.
Risk Score is not available in the CLI.
The Risk Score replaces the Priority Score only after the Snyk Open Source and Snyk Container Projects are re-tested.
You can wait for the Projects to be automatically re-tested (daily for Snyk Open Source and weekly for Snyk Container), or you can manually re-test the Project.
Note that in the API, the relevant fields are still named with priority.When Risk Score is enabled, the scores and factors populated in these fields are based on the Risk Score model as part of the early access stage.
Explore the Risk Score by issue
When looking at Issue card information, hover over the score to see the type of score (Priority or Risk Score) that is being displayed. The Risk Score tooltip provides information about the subscore and the Risk Factors contributing to the score.
About the Risk Score model
The model that powers the Risk Score applies automatic risk analysis for each security issue based on the potential impact and likelihood of exploitability.
The Risk model results from extensive research conducted by the Snyk Security Data Science team and experienced security researchers. The model draws on expertise gained over the years in developing the Snyk Vulnerability Database.
Impact subscore
Objective impact factors are the CVSS impact metrics, Availability, Confidentiality, Integrity, and Scope, calculated based on the CVSS impact subscore. For Container issues, Provider Urgency is also taken into account.
The business criticality Project attribute will be taken into account as a contextual impact factor, increasing or decreasing the impact subscore. For more information, see Project attributes.
Likelihood subscore
Objective likelihood factors are taken into account:
Exploit Maturity
Exploit Prediction Scoring System (EPSS)
Age of advisory
CVSS exploitability metrics: Attack vector, Privileges required, User interaction, and Scope
Social Trends
Malicious Package
Provider Urgency (Snyk Container)
Package popularity (Snyk Open Source)
(Forthcoming) Disputed vulnerability
Contextual likelihood factors then increase or decrease the likelihood subscore:
Reachability (Snyk Open Source Java only, JavaScript to be supported)
Transitive depth
(Forthcoming) Insights such as
Deployed,OS conditionandPublic Facing
Fixability is no longer considered part of the Score Calculation, as the effort needed to mitigate a security issue does not affect the risk it imposes. To focus on actionable issues, use Fixability filters and then use the Risk Score to start with the riskiest issues.
Risk factors drill down
Objective impact risk factors
Confidentiality
Represents the impact on customer’s data confidentiality, based on CVSS definition.
Possible input values: None, Low, High
Integrity
Represents the impact on customer’s data integrity, based on CVSS definition.
Possible input values: None, Low, High
Availability
Represents the impact of customer’s application availability based on CVSS definition.
Possible input values: None, Low, High
Scope
Indicates whether the vulnerability can affect components outside of the target’s security scope, based on CVSS definition. The objective impact subscore is calculated based on the CVSS impact subscore. For more information, see the references on CVSS definitions above and the subscore equations.
| Possible input value | Score impact |
|---|---|
| Impact subscore is not affected. |
| Impact subscore is affected. |
Provider urgency (Snyk Container)
Urgency rating as provided by the relevant operating system distribution security team. For more information, see External information sources for relative importance in severity levels of detected Linux vulnerabilities.
| Possible input value | Score impact |
|---|---|
| Impact subscore increases significantly. |
| Impact subscore increases. |
| Impact subscore decreases significantly. |
| Impact subscore decreases significantly. |
Provider Urgency affects the Likelihood subscore.
Contextual impact risk factor
Business criticality
User-defined Project attribute representing the subjective business impact of the respective application. For more information, see Project attributes.
| Possible input value | Score impact |
|---|---|
| Impact subscore increases. |
| Impact subscore is not affected. |
| Impact subscore decreases. |
| Impact subscore decreases significantly. |
When you apply a business criticality attribute to a Project, a retest is required for the Risk Scores to incorporate the new data. When no Business Criticality is assigned, the Impact subscore will not be affected.
Objective likelihood risk factors
Exploit maturity
Represents the existence and maturity of any public exploit retrieved and validated by Snyk. For more information, see View exploits, How exploits are determined.
| Possible input value | Score impact |
|---|---|
| Impact subscore decreases significantly. |
| Impact subscore decreases slightly. |
| Impact subscore increases. |
| Impact subscore increases significantly. |
EPSS score
Exploit Prediction Scoring System (EPSS), predicting whether a CVE will be exploited in the wild, based on an elaborated model created and owned by the FIRST Organization.
The probability is the direct output of the EPSS model and conveys an overall sense of the threat of exploitation in the wild. This data is updated daily, relying on the latest available EPSS model version. See the EPSS documentation for more details.
Possible input values: EPSS score [0.00-1.00]
The likelihood subscore increases significantly according to the EPSS score.
Attack vector
Represents the context by which vulnerability exploitation is possible, based on the CVSS definition.
| Possible input values | Score impact |
|---|---|
| Likelihood subscore increases. |
| Likelihood subscore decreases according to the level of remote access needed to exploit the vulnerability. |
| Likelihood subscore decreases according to the level of remote access needed to exploit the vulnerability. |
| Likelihood subscore decreases according to the level of remote access needed to exploit the vulnerability. |
Attack complexity
Represents the level of complexity defined by the conditions that must exist to exploit the vulnerability, based on the CVSS definition.
| Possible input values | Score impact |
|---|---|
| Likelihood subscore decreases. |
| Likelihood subscore increases. |
Privileges required
Represents the level of privileges an attacker must possess before successfully exploiting the vulnerability, based on the CVSS definition.
| Possible input values | Score impact |
|---|---|
| Likelihood subscore decreases according to the level of privileges required. |
| Likelihood subscore decreases according to the level of privileges required. |
| Likelihood subscore increases. |