The Risk Score is a dynamic metric ranging from 0 to 100 that quantifies your organization's External Attack Surface Risk with precision. It moves beyond simple vulnerability counting to measure the specific depth of actionable intelligence currently available to adversaries for planning and executing an attack. The governing principle is visibility, as the exposure of your assets, credentials, and vulnerabilities increases, the barrier to entry for a successful breach significantly decreases. By illuminating your infrastructure through an adversarial lens, the Risk Score transforms abstract threats into a clear indicator of breach probability, providing the critical context needed to anticipate and neutralize attacks before they occur.

This system transforms complex, fragmented threat data—from active malware and stolen credentials to critical vulnerabilities—into a single, easy-to-understand metric. By synthesizing these critical signals, the Risk Score empowers your organization with strategic decision-making to prioritize resources effectively, shifting focus from general monitoring to targeted, data-driven remediation of the most critical exposures.

Understanding your score

The score places your organization into one of five categories. This classification helps you immediately understand the urgency of your situation and the resources required for remediation.

How the score is calculated

The score is an aggregation of five specialized indices. Each index measures a specific type of threat, weighted by how critical it is to your security.

How time affects the score

The Risk Score incorporates a Time Decay mechanism to ensure the score reflects your current threat landscape rather than historical data. Based on how time-sensitive a threat is, they will be qualified in the following Decay Factors:

• Heavy Decay: Threats in these categories are extremely time-sensitive. A credential stolen yesterday is an immediate crisis; one stolen three years ago is less likely to be valid. Therefore, the system aggressively reduces the impact of older findings in these categories.
• Moderate Decay: Software vulnerabilities remain dangerous until patched, but newer vulnerabilities (Zero-days or recently disclosed CVEs) often lack established defenses, making them higher risk. The system weights newer CVEs more heavily to drive urgent patching.

The scoring system also applies different temporal logic depending on the nature of the data being analyzed classifying it as Dynamic and Static Risk.

• Dynamic Risk: Applies to the Infrastructure and Typosquatting indices. These indices represent living states that are subject to modification. Therefore, the scores reflect the latest scan results to accurately display the status of the current network configuration.
• Static Risk: Applies to Stealer, Vulnerability, Exposure indices. These indices represent events that happened at a single point in time. Taking into account that once data is leaked, it is out there permanently. The scoring system applies the Time Decay mechanism. While the data remains a threat, the immediate risk level gradually reduces as the information becomes stale or passwords are changed.

Score indices

How to improve your score

To lower your risk score effectively, prioritize your actions based on index weights and leverage automated response tools where available:

1. Hunt Infostealers (Stealer Index)
   Since this index accounts for 40% of your total score, cleaning infected endpoints is the most impactful way to improve your security posture. Locate infected assets immediately to prevent further credential exfiltration.
   Automate defense: If not already implemented, deploy Lumu Defender. This allows for an automated response to malicious command-and-control (C2) communications, mitigating third-party risks in real-time.

1. Secure Accounts (Exposure Index)
   If the system detects recent leaks, immediate action is required to prevent unauthorized access. Force password resets for affected users and ensure Multi-Factor Authentication (MFA) is active.
   Forensic analysis: Use Lumu’s detection capabilities to monitor for Unusual Login or Brute Force incidents. These are often the aftermath of a leak; identifying these patterns helps confirm if a known data leak or infostealer is the root source of an active attack.

1. Patch Critical Systems (Vulnerability Index)
   Focus on internet-facing assets to shut down easy entry points for attackers. Prioritize vulnerabilities with known exploits that match your specific infrastructure profile.

1. Audit Your Network (Infrastructure Index)
   Reduce your attack surface by maintaining strict hygiene across your digital footprint. Close unused ports and decommission old test servers that no longer serve a business purpose.