> ## Documentation Index
> Fetch the complete documentation index at: https://docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Binarly Risk Score
> How the Binarly Risk Score turns exploitation, impact, decision, and finding-type signals into one transparent 0 to 1 priority score, with selectable profiles.
The Binarly Risk Score (BRS) combines the signals the platform already collects about a finding, CVSS, EPSS, EMS, KEV, LEV, SSVC, reachability, detection confidence, and the finding type itself, into a single normalized score between 0 and 1. A higher score means the finding deserves attention sooner.
Every input, weight, and step is open and auditable, and you can switch between scoring [profiles](#scoring-profiles) to match how your team prioritizes work.
## Why a new risk score
Single-metric scoring forces a trade-off. CVSS describes severity but says nothing about whether a vulnerability is being exploited. EPSS predicts exploitation but ignores impact and reachability. A KEV listing is a strong signal but only a yes or no. Ranking findings in a production firmware image means weighing all of these at once, and weighing them differently depending on who is asking.
BRS is built around four goals:
* **Transparency.** Every metric, weight, and calculation step is visible and reproducible.
* **Configurable emphasis.** Profiles re-weight the taxonomy groups for different workflows; you select the profile that matches your task.
* **Data flexibility.** The score uses publicly available data where it exists and Binarly research data where it does not, and new metrics can be added without reworking the formula.
* **Finding-type coverage.** The same model prioritizes known CVEs, unknown UEFI vulnerabilities, secrets, mitigation failures, cryptographic weaknesses, malicious code, supply-chain issues, and hardening weaknesses.
## How the score is built
Each metric belongs to one of four taxonomy groups. Every group produces a weighted subscore, and the four subscores are blended into the final result.
| Group | What it measures |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **Exploitation** | How likely and how easy the finding is to exploit. |
| **Impact** | How much damage exploitation would cause. |
| **Decision** | How confident and actionable the finding is: detection confidence, reachability confidence, fix availability, dispute status. |
| **Name** | A finding-type multiplier derived from the finding name itself. |
The **Name** group replaces the earlier "kind" concept. The finding name (for example `mitigation/uefi/untrusted-ami-test-key`) is matched against a table of prefixes by longest-prefix match, so `mitigation/uefi/untrusted-ami-test-key` resolves to its exact entry while an unlisted `mitigation/uefi/...` name falls back to the closest parent prefix. The matched value scales the score up or down for that class of finding. A few classes carry negative values, which pull the score down when the finding type is inherently low-risk.
## Scoring profiles
The platform ships three profiles. You select one from the Risk Score selector in the findings grid; the three share the same metrics and differ only in how much weight each taxonomy group carries. The alpha columns below are the group weights ($\alpha$) each profile applies.
| Profile | Exploitation | Impact | Decision | Name | Use it for |
| ------------------------------------- | :----------: | :----: | :------: | :--: | -------------------------------------------------- |
| **Balanced** | 0.25 | 0.25 | 0.25 | 0.25 | General assessment and baseline reviews. |
| **Exploitation (Exploitability)** | 0.55 | 0.20 | 0.20 | 0.05 | Threat hunting and active-exploitation triage. |
| **Decision Impact (Actionable Risk)** | 0.10 | 0.35 | 0.40 | 0.15 | Vulnerability management and remediation planning. |
The profiles were renamed for clarity: Exploitation is now Exploitability, and Decision Impact is now Actionable Risk. The findings grid shows the current names. Exploitation leans on the Exploitation group; Decision Impact leans on the Decision and Impact groups.
Profiles change only the ranking emphasis, not the underlying data. The same finding keeps all of its metric values across profiles, so switching profiles reorders findings rather than rescanning them.
### What a profile contains
A profile is a configuration with two parts:
* **Alphas** ($\alpha$): how much each taxonomy group contributes to the final score. The four alphas (exploitation, impact, decision, name) sum to 1.
* **Weights**: per finding category, how much each metric contributes inside its group. A weight is between 0 and 1, and a weight of 0 disables the metric for that category.
Within each finding category, the weights in a group are normalized so the group sums to 1: each metric's weight is divided by the total of its group. A group with a single metric and the alphas themselves are left unchanged.
This normalization runs once when the profile is built, so the scoring formula operates on already-normalized weights. The enumeration-to-number tables, the per-category recoverability factors, and the mapping of metrics to taxonomy groups are shared by every profile, not part of any single profile.
## The formula
The score is a weighted sum over the four groups, clamped to the range 0 to 1:
$$
\mathrm{BinarlyRiskScore} = \operatorname{clamp}_{[0,1]}\!\left( \sum_{g \in G} \alpha_g \cdot s_g \cdot \sum_{m \in g} v_m \cdot w_{g,m} \right)
$$
where, for each group $g$ in $G = \{\text{exploitation}, \text{impact}, \text{decision}, \text{name}\}$:
* $\alpha_g$ is the profile alpha for the group.
* $s_g$ is the redistribution scale for the group (defaults to 1, see [Weight redistribution](#weight-redistribution)).
* $v_m$ is the normalized value of metric $m$, in the range 0 to 1. A missing metric contributes 0.
* $w_{g,m}$ is the profile weight for metric $m$ in the group, already normalized per group (see [What a profile contains](#what-a-profile-contains)). A weight of 0 disables the metric for that finding category.
Because the weights in each group sum to 1 and the alphas sum to 1, and every metric value sits between 0 and 1, the result stays on a comparable 0 to 1 scale across findings and across images. The weights are normalized once when the profile is built, not per score.
### Metric normalization
Every metric is reduced to a value between 0 and 1 before it enters the formula:
* **Ratios** (CVSS base, CVSS exploitability, CVSS impact, EMS) are divided by 10. CVSS uses the highest of the available v2, v3, and v4 scores.
* **Probabilities** (EPSS, LEV, confidence, reachability confidence) are used directly.
* **Booleans** (KEV, public exploit, public PoC, verified exploit, weaponized exploit, SSVC Automatable, known fixed version, not disputed) map to 1 for true and 0 for false.
* **Enumerations** (severity, reachability kind, SSVC states, finding name) map to fixed values from the [appendix tables](#appendix).
A finding can have several reachability results. BRS selects the single entry with the highest `kind value * confidence` product, the most reachable path, and uses its kind and confidence. Environment reachability is selected the same way from its own set.
## Weight redistribution
Not every finding has a value for every metric, usually because the source data does not exist. Treating a missing metric as 0 would silently discard both the metric and its weight, dragging strong findings down for reasons that have nothing to do with risk.
Instead, the weight of a missing metric is partly redistributed to the metrics that do have values in the same group. Each metric has a recoverability factor between 0 and 1 that controls how much of its weight is donated when it is missing. A factor of 1 means the metric's signal is well represented by its neighbors, so its weight moves over in full; a factor of 0 means nothing is donated.
For a group $g$ and finding category $c$, the redistribution scale is:
$$
s_g = \frac{W_{\text{present}} + \displaystyle\sum_{m \,\in\, \text{missing}} w_{g,m} \cdot f_{c,m}}{W_{\text{present}}}, \qquad W_{\text{present}} = \sum_{m \,\in\, \text{present}} w_{g,m}
$$
where $f_{c,m}$ is the recoverability factor for metric $m$ in category $c$ (see [Redistribution factors](#redistribution-factors)). Because the donated weight is shared in proportion to the surviving weights, the whole group scales by one factor rather than rewriting each weight individually. When a group has no surviving metrics ($W_{\text{present}} = 0$), its scale is 1 and the group contributes 0.
## Reading the score
The result is a value between 0 and 1. The platform presents it as a percentile, so a finding scoring higher than most others appears at the top of the list. There are no fixed severity bands: you sort and filter on the score directly rather than mapping it to a label. You do this from the Risk Score column in the findings grid, covered in [Prioritizing with the Risk Score](/user-guides/image-scans/risk-score).
## Metrics reference
All metrics that can feed the score, grouped by taxonomy. Values are normalized to 0 to 1 as described above.
### Exploitation metrics
| Metric | Description | Source | Range |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- | ------------------- | ------- |
| CVSS exploitability score | How easily the vulnerability can be exploited. Highest of CVSS v2/v3/v4. | NVD | 0 - 10 |
| EPSS | Probability the vulnerability will be exploited. Estimated EPSS is used for findings without a published EPSS score. | FIRST.org / Binarly | 0 - 1 |
| [EMS](/resource-center/ems-escalations) | Exploitation Maturity Score, evidence-based exploitation signal. | Binarly | 0 - 10 |
| KEV | Listed in the CISA Known Exploited Vulnerabilities catalog. | CISA | boolean |
| LEV | Likely Exploited Vulnerabilities probability, from historical exploitation data. | CISA / Binarly | 0 - 1 |
| Public exploit | A public exploit is known. | Binarly VDB | boolean |
| Public PoC | A public proof of concept is known. | Binarly VDB | boolean |
| Verified exploit | A verified exploit is known. | Binarly VDB | boolean |
| Weaponized exploit | A weaponized exploit is known. | Binarly VDB | boolean |
| [Reachability kind](/resource-center/asap) | Static reachability classification of the vulnerable code. | Binarly | enum |
| Brly rule | The finding was raised by a Binarly research rule. | Binarly | boolean |
| Secret exploitation | The secret was validated (a secret finding at full confidence). | Binarly | boolean |
| SSVC Automatable | SSVC automatable assessment. | CISA | boolean |
| SSVC Exploitation | SSVC exploitation state. | CISA | enum |
### Impact metrics
| Metric | Description | Source | Range |
| ----------------------------------------- | ------------------------------------------------ | ------- | ------ |
| CVSS base score | Overall CVSS severity. Highest of CVSS v2/v3/v4. | NVD | 0 - 10 |
| CVSS impact score | CVSS impact subscore. | NVD | 0 - 10 |
| [Severity](/resource-center/risk-scoring) | Binarly severity level of the finding. | Binarly | enum |
| SSVC Technical Impact | SSVC technical impact level. | CISA | enum |
### Decision metrics
| Metric | Description | Source | Range |
| -------------------------------------------------- | ---------------------------------------------------------- | ----------- | ------- |
| [Confidence](/resource-center/accuracy-confidence) | Detection confidence for the finding. | Binarly | 0 - 1 |
| Known fixed version | A fixed version is available. | Binarly VDB | boolean |
| Not disputed | The CVE is not disputed. | NVD | boolean |
| [Reachability confidence](/resource-center/asap) | Confidence in the reachability analysis. | Binarly | 0 - 1 |
| SSVC Paranoid Decision | Binarly's SSVC-style decision, biased toward action. | Binarly | enum |
| Environment reachability kind | Reachability of the finding in its deployment environment. | Binarly | enum |
| Environment reachability confidence | Confidence in the environment reachability analysis. | Binarly | 0 - 1 |
### Name metric
| Metric | Description | Source | Range |
| ------ | ----------------------------------------------------------------------- | ------- | -------- |
| Name | Finding-type multiplier from the finding name, by longest-prefix match. | Binarly | -0.3 - 1 |
## Metrics by finding type
The metrics the shipped profiles weight for each finding type, grouped by taxonomy.
| Finding type | Exploitation | Impact | Decision |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Known vulnerability** | EPSS, CVSS exploitability, EMS, KEV, LEV, reachability kind, public exploit, public PoC, verified exploit, weaponized exploit, SSVC Automatable, SSVC Exploitation | CVSS base, CVSS impact, SSVC Technical Impact | Confidence, known fixed version, not disputed, SSVC Paranoid Decision, reachability confidence, environment reachability |
| **Unknown vulnerability (UEFI)** | EPSS, CVSS exploitability, reachability kind | CVSS base, CVSS impact, severity | Confidence, reachability confidence, environment reachability |
| **Mitigation failure** | EPSS, CVSS exploitability, EMS, KEV, LEV, reachability kind | CVSS base, severity | Confidence, reachability confidence, environment reachability |
| **Cryptographic material** | EPSS, CVSS exploitability | CVSS base, CVSS impact, severity | Confidence, environment reachability |
| **Secret** | Secret exploitation | Severity | Confidence |
| **Malicious code** | Brly rule, reachability kind | Severity | Confidence, reachability confidence, environment reachability |
| **Supply-chain failure** | Reachability kind | Severity | Confidence, reachability confidence, environment reachability |
| **Suspicious code** | Brly rule | Severity | Confidence, environment reachability |
| **Weakness** | - | Severity | Confidence, environment reachability |
All finding types also carry the **Name** multiplier. A metric appearing here does not mean it is set for every finding: it means at least one shipped profile assigns it a weight. Metrics with no data for a given finding are handled by [weight redistribution](#weight-redistribution).
## Examples
The same findings reorder under each profile without rescanning. In the platform you switch profiles from the Risk Score selector in the findings grid. The diagrams below show the weight configuration behind each shipped profile.
### Balanced
Equal emphasis across all four groups. This produces a general-purpose ranking that no single factor dominates, which suits baseline reviews.
### Exploitation (Exploitability)
The Exploitation group carries 55 percent of the score. Findings with high EPSS and EMS, a KEV listing, or a known public exploit rise to the top, which suits incident response and threat hunting.
### Decision Impact (Actionable Risk)
The Decision and Impact groups together carry 75 percent of the score. Findings with high detection confidence, available reachability data, and high impact rise to the top, which suits vulnerability management and remediation planning.
## Appendix
### Enumeration values
String metrics map to fixed numeric values before scoring.
| Metric | Value | Score |
| --------------------------------- | ------------------ | :---: |
| **Severity** | Critical | 1 |
| | High | 0.85 |
| | Medium | 0.5 |
| | Low | 0.3 |
| | Unspecified | 0 |
| **Reachability kind** | Entrypoint | 1 |
| | Exported | 0.8 |
| | Referenced | 0.5 |
| | Undetermined | 0.2 |
| | Unreachable | 0.01 |
| **Environment reachability kind** | Entrypoint | 1 |
| | Runtime dependency | 0.8 |
| | Runtime invocation | 0.8 |
| | Undetermined | 0.1 |
| **SSVC Exploitation** | Active | 1 |
| | PoC | 0.6 |
| | None | 0.1 |
| **SSVC Technical Impact** | Total | 1 |
| | Partial | 0.5 |
| **SSVC Paranoid Decision** | Act | 1 |
| | Attend | 0.7 |
| | Track Star | 0.5 |
| | Track | 0.3 |
### Finding name multipliers
The Name group value for each finding-name prefix. Unlisted names fall back to their closest parent prefix.
| Finding type | Name prefix | Value |
| -------------------------- | ---------------------------------------------------- | :---: |
| **Cryptographic material** | `crypto/algorithm/` | -0.3 |
| | `crypto/certificate/` | 0.1 |
| | `crypto/certificate/expired` | 0.9 |
| | `crypto/certificate/invalid` | 0.9 |
| | `crypto/certificate/untrusted` | 0.9 |
| | `crypto/protocol/` | -0.3 |
| | `crypto/rsa/weak-key-parameters` | 0.9 |
| **Known vulnerability** | `vulnerability/known-vulnerability` | 1 |
| **Malicious code** | `malware/known-threat` | 1 |
| | `malware/malicious-behaviour` | 0.9 |
| | `malware/uefi/implant-hook-install` | 0.8 |
| **Mitigation failure** | `mitigation/known-mitigation-failure` | 0.75 |
| | `mitigation/missing-control-flow-integrity` | 0.3 |
| | `mitigation/missing-stack-canaries` | 0.3 |
| | `mitigation/posix/fortify-source-disabled` | 0.1 |
| | `mitigation/posix/nx-disabled` | 0.35 |
| | `mitigation/posix/pie-disabled` | 0.35 |
| | `mitigation/posix/relro-disabled` | 0.4 |
| | `mitigation/posix/relro-partially-enabled` | 0.4 |
| | `mitigation/uefi/dxe/stack-guard-misconfiguration` | 0.4 |
| | `mitigation/uefi/flash-descriptor-misconfiguration` | 1 |
| | `mitigation/uefi/insyde-fdm-misconfiguration` | 1 |
| | `mitigation/uefi/leaked-ami-test-key` | 1 |
| | `mitigation/uefi/memory-protection-misconfiguration` | 0.4 |
| | `mitigation/uefi/missing-rsb-stuffing` | 0.4 |
| | `mitigation/uefi/outdated-amd-microcode-version` | 0.55 |
| | `mitigation/uefi/outdated-dbx` | 0.5 |
| | `mitigation/uefi/outdated-intel-microcode-version` | 0.65 |
| | `mitigation/uefi/outdated-microcode-version` | 0.65 |
| | `mitigation/uefi/pei/stack-guard-misconfiguration` | 0.5 |
| | `mitigation/uefi/secure-boot-setup-mode` | 1 |
| | `mitigation/uefi/uefi-shell-inclusion` | 1 |
| | `mitigation/uefi/uefiplat-weak-configuration` | 0.85 |
| | `mitigation/uefi/untrusted-ami-test-key` | 1 |
| | `mitigation/uefi/untrusted-insyde-test-key` | 1 |
| | `mitigation/uefi/untrusted-phoenix-test-key` | 1 |
| | `mitigation/uefi/vulnerable-amd-microcode-version` | 1 |
| | `mitigation/uefi/vulnerable-intel-microcode-version` | 1 |
| **Secret** | `secret/api-credentials` | 1 |
| | `secret/credentials` | 1 |
| | `secret/encryption-key` | 1 |
| | `secret/generic` | 1 |
| | `secret/jwt-token` | 1 |
| | `secret/oauth-credentials` | 1 |
| | `secret/private-key` | 1 |
| | `secret/webhook-url` | 1 |
| **Supply-chain failure** | `supply-chain/known-supply-chain-issue` | 1 |
| **Suspicious code** | `suspicious/posix/ctors-dtors` | 0.4 |
| | `suspicious/posix/dt-needed` | 0.4 |
| | `suspicious/posix/entrypoint` | 0.4 |
| | `suspicious/posix/executable-data` | 0.4 |
| | `suspicious/posix/ifuncs` | 1 |
| | `suspicious/posix/init-fini` | 0.4 |
| | `suspicious/posix/no-stdlib` | 0.4 |
| | `suspicious/posix/packed-elf` | 0.4 |
| | `suspicious/posix/plt-got` | 0.4 |
| | `suspicious/posix/pt-note-conversion` | 0.4 |
| | `suspicious/posix/relocations` | 0.4 |
| | `suspicious/posix/reverse-text` | 0.4 |
| | `suspicious/posix/text-padding` | 0.4 |
| | `suspicious/uefi/resolve-imports` | 0.3 |
| | `suspicious/uefi/resolve-relocations` | 0.3 |
| **Unknown vulnerability** | `vulnerability/uefi/` | 0.2 |
| | `vulnerability/uefi/get-set-variable` | 0.2 |
| | `vulnerability/uefi/leaked-boot-guard-bpm-key` | 1 |
| | `vulnerability/uefi/leaked-boot-guard-km-key` | 1 |
| | `vulnerability/uefi/pkfail` | 0.9 |
| | `vulnerability/uefi/secure-boot-bypass` | 1 |
| | `vulnerability/uefi/smm-get-set-variable` | 0.2 |
| **Weakness** | `weakness/linux/kernel-configuration` | 0.8 |
| | `weakness/posix/not-stripped` | 0.25 |
| | `weakness/posix/rpath-set` | 0.6 |
| | `weakness/posix/runpath-set` | 0.6 |
| | `weakness/posix/unsafe-function-call` | 0.8 |
| | `weakness/posix/unsafe-functions/summary` | 0.25 |
### Redistribution factors
The recoverability factor $f_{c,m}$ for each metric, by finding category. Higher values donate more of a missing metric's weight to its surviving neighbors.
| Category | Metric | Factor |
| -------------------------------- | ------------------------- | :----: |
| **Cryptographic material** | confidence | 0 |
| | CVSS base score | 1 |
| | CVSS exploitability score | 1 |
| | CVSS impact score | 1 |
| | EPSS probability | 1 |
| | is untrusted key | 1 |
| | name | 0 |
| | reachability confidence | 0 |
| | reachability kind | 0 |
| | severity | 0 |
| **Malicious code** | brly rule | 1 |
| | confidence | 0 |
| | name | 0 |
| | reachability confidence | 0 |
| | reachability kind | 0 |
| | severity | 0 |
| **Mitigation failure** | brly rule | 1 |
| | confidence | 0.9 |
| | CVSS base score | 1 |
| | CVSS exploitability score | 0.9 |
| | CVSS impact score | 1 |
| | EMS score | 1 |
| | EPSS probability | 0.8 |
| | is untrusted key | 1 |
| | KEV | 1 |
| | LEV score | 1 |
| | name | 1 |
| | reachability confidence | 1 |
| | reachability kind | 1 |
| | severity | 0.8 |
| **Secret** | confidence | 0 |
| | name | 0 |
| | secret exploitation | 0 |
| | severity | 0 |
| **Supply-chain failure** | brly rule | 0.2 |
| | confidence | 0 |
| | name | 0 |
| | reachability confidence | 0.7 |
| | reachability kind | 0.7 |
| | severity | 0 |
| **Suspicious code** | confidence | 0 |
| | name | 0 |
| | severity | 0 |
| **Known vulnerability** | brly rule | 0.4 |
| | confidence | 0 |
| | CVSS base score | 0.7 |
| | CVSS exploitability score | 0.8 |
| | CVSS impact score | 0.8 |
| | EMS score | 0.6 |
| | EPSS probability | 0 |
| | KEV | 1 |
| | is known ransomware use | 0.8 |
| | known fixed version | 1 |
| | LEV score | 1 |
| | not disputed | 1 |
| | public exploit | 1 |
| | public PoC | 1 |
| | verified exploit | 1 |
| | weaponized exploit | 1 |
| | reachability confidence | 0 |
| | reachability kind | 0 |
| | severity | 0 |
| | SSVC Automatable | 0.9 |
| | SSVC Exploitation | 0.9 |
| | SSVC Paranoid Decision | 0.7 |
| | SSVC Technical Impact | 0.9 |
| **Unknown vulnerability (UEFI)** | confidence | 0.7 |
| | CVSS base score | 1 |
| | CVSS exploitability score | 1 |
| | CVSS impact score | 1 |
| | EPSS probability | 0.5 |
| | name | 0.7 |
| | reachability confidence | 1 |
| | reachability kind | 1 |
| | severity | 0 |
| **Weakness** | confidence | 0 |
| | name | 0 |
| | severity | 0 |
## Related
Pick a profile and sort and filter findings by risk score in the findings grid.
How reachability feeds the exploitation and decision groups.
The evidence-based exploitation signal in the score.
How detection confidence, a decision-group input, is set.