Risk Scoring Engine
Relevant source files
The following files were used as context for generating this wiki page:
The Risk Scoring Engine is a sophisticated analytical component of the FixOps platform designed to quantify security risks through multi-dimensional analysis. It integrates structural priors, real-time threat intelligence, and business context to produce a "posterior risk" score that enables precise prioritization of vulnerabilities across diverse asset surfaces such as cloud, containers, and applications. Sources: scripts/demo_run.py:1-15, scripts/demo_orchestrator.py:1-15
The engine operates on a bidirectional scoring philosophy: Day-0 analysis focuses on architectural and environmental factors like internet exposure and data adjacency, while Day-N analysis incorporates dynamic signals such as Known Exploited Vulnerabilities (KEV) and Exploit Prediction Scoring System (EPSS) data. This approach allows the platform to identify critical risks even before active exploitation is reported in the wild. Sources: scripts/demo_run.py:18-25, scripts/demo_orchestrator.py:145-155
Core Architecture and Data Flow
The engine follows a structured pipeline that transforms raw scanner findings into prioritized security intelligence.
High-Level Data Pipeline
- Ingestion & Normalization: Consolidates data from multiple scanners (Snyk, Tenable, Wiz, etc.) into a unified format.
- Context Enrichment: Overlays business metadata including application tier, data classification, and asset criticality.
- Algorithmic Scoring: Applies Bayesian/Markov models and weighted heuristics to calculate risk scores.
- Correlation: Maps findings to MITRE ATT&CK techniques and historical patterns.
- Attestation: Generates cryptographically signed evidence bundles for audit compliance.
Sources: scripts/demo_orchestrator.py:10-25, e2e_orchestration/artifacts/APP1_insurance/pipeline_result.json
The diagram above illustrates the end-to-end flow from raw vulnerability ingestion to the generation of signed evidence and executive reporting. Sources: scripts/demo_orchestrator.py:10-25, scripts/demo_run.py:18-35
Scoring Methodologies
The engine implements multiple scoring strategies depending on the deployment mode (Demo, Enterprise, or Advanced Pentest).
Bidirectional Risk Scoring
Used primarily in the demo and core pipeline, this method splits risk into two primary vectors:
| Component | Weight | Factors Included |
|---|---|---|
| Day-0 (Structural) | 60% | Pre-auth RCE, Internet Exposure, Data Adjacency, Blast Radius, Compensating Controls |
| Day-N (Dynamic) | 40% | KEV Status, EPSS Percentile, CVSS Base Score |
Sources: scripts/demo_run.py:65-80, scripts/demo_orchestrator.py:145-160
Bayesian Markov Risk Scoring
This advanced approach calculates "Posterior Risk" by evaluating contribution vectors. It adjusts scores based on environmental variables, such as reducing risk when compensating controls like WAF or mTLS are detected. Sources: scripts/demo_orchestrator.py:145-200
Proprietary Scoring Engine
Found in the reachability and enterprise modules, this engine uses sigmoid functions and decay models (exponential, linear, logarithmic) to calculate temporal risk.
| Factor | Description |
|---|---|
| Exploitability | Boosted by SQL/Command injection CWEs or KEV listing. |
| Impact | Weighted by asset criticality (e.g., Mission Critical = 1.2x multiplier). |
| Exposure | Normalized values: Internet (1.0), Public (0.9), Internal (0.5). |
| Temporal | Decays risk scores as vulnerabilities age since their published date. |
Sources: tests/risk/reachability/test_proprietary_scoring.py:50-150
Key Logic Components
Business Context Overlay
The BusinessContextOverlay class determines the impact of a finding based on the asset's role in the organization. It categorizes assets into tiers (api, infrastructure, container) and assigns criticality levels based on the sensitivity of the data handled (e.g., PHI or PCI data results in 'critical' criticality). Sources: scripts/demo_orchestrator.py:55-100
Threat Intelligence Integration
The engine integrates several external feeds to refine risk scores:
- KEV (CISA): Provides a 30-point boost to the risk score if the CVE is known to be actively exploited.
- EPSS (FIRST): Adds a variable boost based on the probability of exploitation (e.g., EPSS > 0.89 adds 18 points).
- CWE Mapping: Specific vulnerability types (SQLi, XXE) receive higher exploitability weights.
Sources: tests/risk/test_scoring.py:250-280, e2e_orchestration/artifacts/APP1_insurance/pipeline_result.json, fixops-enterprise/src/services/advanced_pentest_engine.py:450-500
The class diagram shows the relationship between scoring engines and the resulting RiskScore data structures used for reporting. Sources: scripts/demo_run.py:40-60, tests/risk/reachability/test_proprietary_scoring.py:20-40
Output and Reporting
The engine produces several artifacts after scoring completion:
- Prioritized Findings: A top-N list (default 100) of the most critical issues.
- Executive Dashboard: High-level summaries including risk trends, mean time to remediate (MTTR), and compliance scores (SOC2, ISO27001).
- Natural Language Rationales: Explanations generated for each finding describing why it was assigned a specific risk tier (e.g., "Internet Exposure increases risk by 0.20").
- Evidence Bundles: RSA-signed ZIP files containing the manifest, statistics, and prioritized JSON results for audit trails.
Sources: scripts/demo_run.py:280-350, fixops-enterprise/src/services/advanced_pentest_engine.py:800-850, e2e_orchestration/artifacts/APP1_insurance/pipeline_result.json
Conclusion
The Risk Scoring Engine transforms FixOps from a simple vulnerability aggregator into a decision-making platform. By combining static architectural analysis with dynamic threat intelligence, it ensures that security teams focus on the "reachable" and "exploitable" risks that actually threaten business operations. Sources: scripts/demo_orchestrator.py:1-15, fixops-enterprise/src/services/advanced_pentest_engine.py:1-20