Risk score computation

    In ManageEngine SecureAI, the risk score states the security posture of one AI vendor account as a figure out of 100, with a rating and a history of the same figure across successive assessments. It gives you one measure that holds across every account of the same AI vendor, so you can report posture can be reported to a governance forum, weigh accounts against each other, and follow the effect of corrections. Use the risk score to decide which account needs attention, and to show whether the position is improving. The exposures behind a score are corrected in the AI vendor's own administration console.

    How the risk score is calculated

    Every risk indicator evaluated for an account carries a weight and produces a risk exposure, which is the share of the records it checked that were at fault. Risk indicators explains both values. Weight is what separates one indicator from another, so at the same exposure a heavier indicator moves the score further than a lighter one. The score is the weighted mean of those exposures. Only indicators reporting a failure enter the calculation. A score cannot exceed 100.

    Risk score = (Sum of (Risk exposure x Weight) for every failing risk indicator / Sum of those weights) x 100

    Prerequisites

    Complete the following before you rely on the risk score.

    • Sign in with permissions that include AI Risk Assessment. Of the default roles, only Risk & Audit Analyst carries it.
    • Sync the AI vendor account and confirm the collection has completed, since a score is calculated from collected records alone.
    • Allow more than one assessment to complete before you read the score history. A single assessment plots a single point.
    Note:
    • A risk score belongs to one AI vendor account. No combined figure is calculated across the accounts of an AI vendor or across vendors.
    • Scores from two different AI vendors are not comparable. Each vendor has its own indicator set, so the two figures are built from different checks.
    • The assessment shows the rating but not the ranges behind it, so you cannot tell from the assessment where one rating ends and the next begins.
    • A correction made in the AI vendor console leaves the score unchanged until the next collection has completed.
    • An account still returns a score when most of its indicators could not be evaluated. A low figure is therefore not on its own evidence of a well-configured account.
    • Score trend intervals are not offered for every AI vendor. Anthropic Claude and GitHub Copilot offer Monthly and Quarterly; Google Gemini offers neither.

    Working with the risk score

    A risk score is produced for one AI vendor account at a time, so you choose the AI vendor and then the account before reading it. The score runs out of 100, and a higher figure means more exposure. It states where the account stood at the assessment that produced it, not where it stands today. Click How is the risk score calculated? to see the calculation.

    A single score says where an account stands. Comparing one assessment with the next is how you tell whether an account is improving. The Score Trend chart plots the score across successive assessments, with Monthly and Quarterly as the span. Two accounts can carry the same score when one has been in good order for months and the other was corrected last week. Only the history tells them apart.

    To see what produced a score, open the risk categories of the same assessment and work through to the individual indicators. Neither the score nor its history links to them directly. Each indicator gives the share of records at fault and the weight it carries, and those are the two figures the score is calculated from.

    Tips

    • To bring a score down, start with the failing indicators that carry the most weight rather than the ones that are quickest to close. Weight is given with each indicator, and correcting several low-weight ones changes the score very little.
    • A score that has not moved between assessments does not always mean an account that has not changed. One indicator's risk exposure closing as another's opens leaves the average where it was, so check the indicator results before you report that nothing has changed.
    • A score that rises after a collection often reflects an indicator that started returning records, not a new misconfiguration. Check which indicators changed status before you escalate.
    • When you pass a score on to someone else, give the Last Generated On date with it. Without that date, two people reading on different days can quote the same account at two different figures.
    • Plot the score's history by month or by quarter to suit how often you report on the account, not how often SecureAI collects. Daily collection and a quarterly review work together without conflict.