Utilizing Predictive Risk Scoring

Predictive Risk Scoring in Invicti Enterprise helps you prioritize your web assets prior to scanning by giving an indication of how likely each website is to have vulnerabilities. This guide shows you how to use Predictive Risk Scoring to order and filter your discovered web assets based on their Risk Score, so you can focus on scanning and fixing your most vulnerable websites first.  

How to enable or disable Predictive Risk Scoring

To start using Predictive Risk Scoring, you first need to ensure that the feature is enabled in the Discovery Settings by following the steps below:

1. Log in to Invicti Enterprise.
2. Go to Discovery > Settings.
3. Select Risk Scoring on the Application and Service Discovery Settings page.
4. Select (to enable) or deselect (to disable) the checkbox next to Enable Risk Scoring.
5. Click Save & Recrawl.

How to use Predictive Risk Scoring

Predictive Risk Scoring runs in the background as part of the Discovery Service. Risk Scores are displayed on the Discovered Websites page for each of your discovered web assets. Filtering and sorting your discovered web assets according to their Risk Score allows you to easily determine which sites to scan immediately and which sites can be scanned next.

How to view Risk Scores

1. Go to Discovery > Discovered Websites.
2. The Discovered Websites page displays a table with details of each web asset that has been detected by Invicti.

3. The third column in the table displays the Risk Score for each web asset. The possible risk scores are:

• Critical: The site is predicted to have at least one critical severity vulnerability. 
• High: The site is predicted to have at least one high severity vulnerability.
• Medium: The site is predicted to have at least one medium severity vulnerability.
• Low: The site is predicted to have at least one low severity vulnerability.
• Undetermined: Invicti was unable to calculate a risk score for the site.
• Temporarily Unavailable: A risk score cannot be calculated at this time. Check back later.
• Scoring queued: The risk score will be calculated soon and will update its state once complete.
• Loading: The risk score is currently being calculated and will be displayed shortly.

How to filter by Risk Score

1. Click the search icon next to Risk Score. The filter dialog appears.  
2. Use the Value field drop-down to select a risk score from the available options that appear.

3. Select Apply. Your Discovered Websites are now displayed according to the filter you specified.
4. To clear your filter settings, click the X in the filter dialog, then select Apply.

How to sort by Risk Score

1. Click the Risk Score heading on the Discovered Websites table.
2. Your web asset discovery results are now displayed in ascending or descending priority order (depending on the direction of the arrow), with critical as the highest priority risk score.

How to refresh Risk Score results

1. Use the checkboxes on the left of the Discovered Websites table to select web assets to refresh their Risk Score.
2. Click Refresh Risk.

3. Select Refresh in the Refresh Risk Score dialog.

How to import discovered websites for scanning

After using the Risk Score information to identify your most vulnerable web assets, you can import those websites to immediately start scanning them for vulnerabilities. (For more information, refer to Managing the Discovered Websites List).

1. On the Discovered Websites page, use the checkboxes on the left of the table to select websites to import for scanning.
2. Click + Create.

3. If you have Target Groups set up, select the relevant Target Group or use the Default group.
4. Use the drop-down menu to select an appropriate Technical Contact. New issues will be assigned to the user you select.
5. In the Website Tags field, enter any tags you would like to apply for the website(s).
6. Click Save.

The websites have now been imported and are available to view on the Targets page. From this page, you can now run a scan of the website. Alternatively, go to Scans > New Scan and click in the Target URL field to select your newly imported website to run a scan.

Further resources

Refer to the following documentation for information on how to complete all the Scan Settings before launching a scan:  

• Creating a New Scan
• Overview of Scan Profiles
• Overview of Scan Policies