Risk scoring

Each endpoint receives a dynamic risk score from 0 to 100, mapped to the High, Medium, and Low severity levels. The score is calculated from multiple factors and is updated as the product observes new traffic and configuration changes.

Risk score inputs

Input	Effect on risk
Authentication status	Missing authentication increases risk
Shadow API status	Shadow endpoints carry higher risk
Zombie API status	Endpoints with no recent traffic carry higher risk
HTTP method	PUT and DELETE methods carry higher risk than GET
Predictable path indicators	Paths such as /admin, /settings, /auth, or paths with static identifiers raise risk
Sensitive data presence	Detected categories such as Email, Credit Card, and SSN raise risk
Sensitive data location	Sensitive data in responses carries higher risk than in requests

Severity levels

The numeric score is mapped to a severity level:

Severity	Score range
Low	Lower end of the 0–39 scale
Medium	Middle of the 40–69 scale
High	Upper end of the 70–100 scale

Severity levels are shown on the dashboard, in the per-domain inventory, and in exported reports.

Using the risk score for triage

The risk score is intended to support prioritization. A recommended triage order is:

1. Review High-severity endpoints first, with particular attention to shadow APIs and unauthenticated endpoints carrying sensitive data.

2. Address Medium-severity endpoints based on business context and exposure.

3. Periodically review Low-severity endpoints to catch drift over time.