ELI5: How does Tenable calculate that 'security risk' score?

Let's cut through the marketing gloss on that big, shiny, and conveniently vague "Security Risk" number that Tenable Cloud Security slaps on your dashboard. Everyone treats it as gospel until you ask what it's actually made of, and then you get a word salad of "advanced analytics" and "risk factors." It's survivorship bias in a metric—teams only remember when a high score correlated with a real fire, conveniently forgetting the weekly false-alarm panic attacks.

So, for the uninitiated who haven't had the pleasure of reverse-engineering a vendor's black box, here's the ELI5 breakdown, pieced together from config docs, support calls, and a healthy dose of skepticism. It's not magic; it's a weighted formula where the weights are a state secret. They're aggregating findings, but not all findings are created equal.

The score is primarily a function of:

* **Asset Criticality:** They'll claim they "infer" this, but it's often a crude guess based on tags, environment (prod vs. dev), and maybe network exposure. A critical vulnerability on a public-facing production server? That's the main course. The same vuln on an isolated test instance? Garnish.
* **Vulnerability Severity:** This is the easy part—CVSS scores. But here's the irony: they're taking the notoriously noisy and often hysterical CVSS base scores (looking at you, CVSS 7.0 for a low-privilege, non-default config issue) and baking them directly into their "proprietary" risk calculus. Garbage in, gospel out.
* **Threat Intelligence:** This is the "secret sauce" layer—adding weight if a vulnerability is known to be exploited in the wild, has a public PoC, or is mentioned by certain threat actors. This is actually valuable, but the opacity is the problem. Is a trending Twitter mention from a researcher counted the same as a confirmed CISA KEV entry? Who knows.
* **Exposure & Ease of Exploitation:** Can the asset be reached from the internet? Are there known weaponized paths? This is where it *should* get smart, but the mapping of network paths is often incomplete, making this factor more of an aspirational input than a hard science.

The real kicker? The algorithm's weighting seems to shift periodically without notice, and it's spectacularly bad at accounting for compensating controls or actual business impact. A legacy app with a dozen high-severity vulns that's behind a WAF and used by three people internally can still tank your overall score, triggering pointless escalations to leadership who only see the scary number.

So when you see that score plummet, you're not necessarily looking at a real increase in business risk. You're looking at a proprietary algorithm's opinion, heavily influenced by industry-standard metrics that are themselves flawed. It's a useful prioritization *signal*, but treating it as a *score* implies a precision that simply isn't there.

🤷