Risk Model ¶

What this is¶

Risk Model groups your findings and CVEs by the fix that resolves them. Many findings often
share one fix — upgrading one package, changing one policy — so each row here is one piece of
work, with how much risk it removes. It also shows the factors behind each score, so you can see
why something ranks where it does.

The page covers your whole workspace; it has no application dropdown.

What is on the screen¶

Rank by — Leverage (fewest actions), Score (magnitude) or Severity (worst first).
One row per group: its title, severity and leverage (×N leverage — how many findings the
one fix resolves). Expand a row for:
remediation — the fix this group shares;
underlying — how many findings it groups;
blast radius — how many records are exposed;
apps — how many applications it spans;
the scoring factors and their values.

When this page is empty¶

No risk items yet. Groups are built from findings and CVEs and refresh every few minutes. They
appear once the scanner has reported findings — see Getting started.

How to use it¶

Do the highest-leverage work first¶

Set Rank by to Leverage (fewest actions).
Expand the top group and read its remediation.

Get a fix suggestion¶

Expand a group and click Suggest a fix for this group →. A tailored suggestion is generated
for that group. Session ids in it are links — click one to open that session in
Traffic.

Close a group once it is fixed¶

Expand the group and click Remediate group….
Read the preview: Suppresses N finding(s) across M app(s).
Click Confirm suppress-all, or Cancel.

To reopen it, click Undo (reopen group).

Where to go next¶

A session id in a suggested fix → that session in Traffic.
Supply Chain and Code — the CVEs behind dependency groups.

How you get here¶

Sidebar → Observe → Risk Model.