Risk score calculation example for Vulnerability Response
reference australia Updated Sep 10, 2026 2 min read vuln-calc-risk-rule-example.md
You can determine the risk score calculators to generate risk scores that use the vulnerability and asset data unique to your organization.
Example of determining risk rule calculators scores
The following example demonstrates how scores for risk rule calculators are determined.
Assume that a risk rule calculator is configured with the fields in this table:
|
Field |
Weightage |
Weight breakdown |
|---|---|---|
|
Vulnerability.Severity |
50 |
Default: 20 1 - Critical: 100 2 - High: 80 3 - Medium: 60 4 - Low: 40 5 - None: 20 |
|
Vulnerability.Exploit Exists |
50 |
Default: 50 Yes: 100 No: 0 |
| ID | Vulnerability severity | Vulnerability exploit exists |
|---|---|---|
| VIT00001 | 1 - Critical | 1 - Yes |
| VIT00002 | 2 - High | 1 - Yes |
| VIT00003 | 3 - Medium | 2 – No |
| VIT00004 | 4 - Low | 2 – No |
| VIT00005 | 5 - None | 2 – No |
The risk score calculation for the vulnerable items is calculated based on the formula:
Risk Score = (W(severity) * FV (severity). + W(exploitexists) * FV(exploit exists)) / 100
where W is the weight and FV is the weight percentage of the field value.
The resulting risk score for these vulnerable items is described in this table:
| ID | Vulnerability severity (50%) | Vulnerability exploit exists (50%) | Resultant risk score |
|---|---|---|---|
| VIT00001 | 1 – Critical (50% x 100) | 1 – Yes (50% x 100) | 100 |
| VIT00002 | 2 – High (50% x 80) | 1 – Yes (50% x 100) | 90 |
| VIT00003 | 3 – Medium (50% x 60) | 2 – No (50% x 0) | 30 |
| VIT00004 | 4 – Low (50% x 40) | 2 – No (50% x 0) | 20 |
| VIT00005 | 5 - None (50% x 20) | 2 – No (50% x 0) | 10 |
Note: For VIT00005, because the value of the severity is empty, the default weightage is applied.
If the weightage percentage is changed for one of the field values, see this table for the results:
|
Field |
Weightage |
Weight breakdown |
|---|---|---|
|
Vulnerability.Severity |
50 |
*revised value
|
|
Vulnerability.Exploit Exists |
50 |
|
|
ID |
Vulnerability severity (50%) |
Vulnerability exploit exists (50%) |
Resultant risk score |
|---|---|---|---|
|
VIT00001 |
1 – Critical (50% x 100) |
1 – Yes (50% x 100) |
100 |
|
VIT00002 |
2 – High (50% x 70) *revised value |
1 – Yes (50% x 100) |
85 *revised value |
|
VIT00003 |
3 – Medium (50% x 60) |
2 – No (50% x 0) |
30 |
|
VIT00004 |
4 – Low (50% x 40) |
2 – No (50% x 0) |
20 |
|
VIT00005 |
5 - None (50% x 20) |
2 – No (50% x 0) |
10 |
251 lines · 4.2 KB
--- title: Risk score calculation example for Vulnerability Response description: You can determine the risk score calculators to generate risk scores that use the vulnerability and asset data unique to your organization. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vuln-calc-risk-rule-example.html release: australia product: Vulnerability Response classification: vulnerability-response topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 2 breadcrumb: [Vulnerability Response reference information, Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Risk score calculation example for Vulnerability Response You can determine the risk score calculators to generate risk scores that use the vulnerability and asset data unique to your organization. ## Example of determining risk rule calculators scores The following example demonstrates how scores for risk rule calculators are determined. Assume that a risk rule calculator is configured with the fields in this table: <table id="table_vdf_v5c_tpb"><thead><tr><th> Field </th><th> Weightage </th><th> Weight breakdown </th></tr></thead><tbody><tr><td> Vulnerability.Severity </td><td> 50 </td><td> Default: 20 1 - Critical: 100 2 - High: 80 3 - Medium: 60 4 - Low: 40 5 - None: 20 </td></tr><tr><td> Vulnerability.Exploit Exists </td><td> 50 </td><td> Default: 50 Yes: 100 No: 0 </td></tr></tbody> </table>Also, assume that the vulnerable items that are shown in this table are present in the system: |ID|Vulnerability severity|Vulnerability exploit exists| |---|----------------------|----------------------------| |VIT00001|1 - Critical|1 - Yes| |VIT00002|2 - High|1 - Yes| |VIT00003|3 - Medium|2 – No| |VIT00004|4 - Low|2 – No| |VIT00005|5 - None|2 – No| The risk score calculation for the vulnerable items is calculated based on the formula: `Risk Score = (W(severity) * FV (severity). + W(exploitexists) * FV(exploit exists)) / 100` where **W** is the weight and **FV** is the weight percentage of the field value. The resulting risk score for these vulnerable items is described in this table: |ID|Vulnerability severity \(50%\)|Vulnerability exploit exists \(50%\)|Resultant risk score| |---|------------------------------|------------------------------------|--------------------| |VIT00001|1 – Critical \(50% x 100\)|1 – Yes \(50% x 100\)|100| |VIT00002|2 – High \(50% x 80\)|1 – Yes \(50% x 100\)|90| |VIT00003|3 – Medium \(50% x 60\)|2 – No \(50% x 0\)|30| |VIT00004|4 – Low \(50% x 40\)|2 – No \(50% x 0\)|20| |VIT00005|5 - None \(50% x 20\)|2 – No \(50% x 0\)|10| **Note:** For VIT00005, because the value of the severity is empty, the default weightage is applied. If the weightage percentage is changed for one of the field values, see this table for the results: <table id="table_svk_ywc_tpb"><thead><tr><th> Field </th><th> Weightage </th><th> Weight breakdown </th></tr></thead><tbody><tr><td> Vulnerability.Severity </td><td> 50 </td><td> - Default: 20 - 1 - Critical: 100 - **2 - High: 70** \*revised value - 3 - Medium: 60 - 4 - Low: 40 </td></tr><tr><td> Vulnerability.Exploit Exists </td><td> 50 </td><td> - Default: 50 - Yes: 100 - No: 0 </td></tr></tbody> </table>The risk score for the vulnerable items after reapplying the calculator is shown in this table: <table id="table_whl_xxc_tpb"><thead><tr><th> ID </th><th> Vulnerability severity \(50%\) </th><th> Vulnerability exploit exists \(50%\) </th><th> Resultant risk score </th></tr></thead><tbody><tr><td> VIT00001 </td><td> 1 – Critical \(50% x 100\) </td><td> 1 – Yes \(50% x 100\) </td><td> 100 </td></tr><tr><td> VIT00002 </td><td> **2 – High \(50% x 70\)** \*revised value </td><td> 1 – Yes \(50% x 100\) </td><td> **85** \*revised value </td></tr><tr><td> VIT00003 </td><td> 3 – Medium \(50% x 60\) </td><td> 2 – No \(50% x 0\) </td><td> 30 </td></tr><tr><td> VIT00004 </td><td> 4 – Low \(50% x 40\) </td><td> 2 – No \(50% x 0\) </td><td> 20 </td></tr><tr><td> VIT00005 </td><td> 5 - None \(50% x 20\) </td><td> 2 – No \(50% x 0\) </td><td> 10 </td></tr></tbody> </table>
| title | Risk score calculation example for Vulnerability Response |
| description | You can determine the risk score calculators to generate risk scores that use the vulnerability and asset data unique to your organization. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vuln-calc-risk-rule-example.html |
| release | australia |
| product | Vulnerability Response |
| classification | vulnerability-response |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Vulnerability Response reference informationVulnerability ResponseUnified Security Exposure ManagementSecurity Operations |