> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/risk-scores/how-is-enginsights-own-risk-score-calculated.md).

# How is Enginsight's own risk score calculated?

Enginsight's own risk score is calculated based on the Common Vulnerability Scoring System (CVSS), an industry standard for assessing the severity of vulnerabilities in IT systems.

The risk score extends the CVSS by taking into account the number of corresponding vulnerabilities identified in your own network. This makes it easier to prioritize vulnerability remediation.

The higher the calculated risk score, the higher the priority with which vulnerabilities should be remediated.

***

## Calculation Method

To calculate Enginsight's own risk score, the CVSS severity rating of a vulnerability is first converted into an internal point system:

* The severity level **Critical** corresponds to **100** points.
* The severity level **High** corresponds to **50** points.
* The severity level **Medium** corresponds to **10** points.
* The severity level **Low** corresponds to **1** point.

Next, Enginsight determines how often the corresponding vulnerability occurs in the monitored IT system.

Finally, the point value is multiplied by the number of vulnerabilities.

***

## Calculation Examples

Enginsight's own risk score is used throughout the platform. Below, we show you two examples of how we calculate this value.

### Example 1: Rating a Single Vulnerability

<div align="left"><figure><img src="/files/X66vZwVLKddDymhr04Mm" alt=""><figcaption></figcaption></figure></div>

The screenshot above shows that the vulnerability **Unterstützt SMBv1** (Supports SMBv1) is rated as **Critical** according to the CVSS. This corresponds to 100 points.&#x20;

In total, the vulnerability was detected across two target systems on 3 ports, so it occurs three times.

This results in the calculation **3 x 100 = 300** as the risk score for the vulnerability.

### Example 2: Overall Rating of a Host

<figure><img src="/files/GdOZt4FQmupEcJznzUWy" alt=""><figcaption></figcaption></figure>

Looking at the overall rating of a server that is being checked for vulnerabilities, you can see the following:

* **1** vulnerability with the severity level **Critical**
* **1** vulnerability with the severity level **High**
* **6** vulnerabilities with the severity level **Medium**
* **12** vulnerabilities with the severity level **Low**

According to Enginsight's internal point system, the total calculation is as follows:

* 1 x 100 = 100
* 1 x 50 = 50
* 6 x 10 = 60
* 12 x 1 = 12

The total risk score for the server is therefore **100 + 50 + 60 + 12 = 222**.

***