Vulnerability Risk Rating

Measuring Adversarial Risk
By capturing threat context in our Vulnerability Risk Rating, Ivanti is able
to consistently prioritize vulnerabilities that are key indicators of potential
compromise across host and application findings.

What is Vulnerability Risk Rating?
Vulnerability Risk Rating (VRR) considers industry-standard Common Vulnerability Scoring System (CVSS), Common
Weakness Enumeration (CWE) data, OWASP (Open Web Application Security Project), open-source threat intelligence,subject matter expertise, trending information, and more. VRR represents the risk posed by a given vulnerability, provided
as a numerical score between 0 and 10, to an organization or business. The higher the risk, the higher the VRR.

To assign a VRR to an individual vulnerability, Ivanti Neurons

substitutes the CVSS v2 when v3 is not provided. If aidentifies the vulnerability’s threat factor and determines thevulnerability lacks a CVE association, the scanner reportedbase score. Parameters such as Exploits and Malware,

severity normalized on a scale from 0 to 10 is used.

Trending Threats, Ransomware, and Security Research arecorrelated and normalized into a unified proprietary database

The final step in the VRR calculation methodology is to pass all

known as the Ivanti Neurons for Vulnerability Knowledge

the above parameters into a sequence of data-driven

Base. The greatest risk associated with the available threatalgorithms that map each parameter value to a corresponding

intelligence is factored into the equation.

numerical value, and then compute the explicit VRR using
those mapped values. Each vulnerability’s risk rating lies within

The next step in computing VRR is the assignment of the baseone of a set of severity groups according to its numericalscore. Ivanti utilizes the CVSS v3 where available, andvalue: Critical, High, Medium, Low, or Informational.

Threat & Vulnerability Component Analysis
Ivanti Neurons for

Vulnerability
Knowledege Base*

Exploits & Malware
Default Credentials
Security ResearchFinding

Trending
Ransomware

Vulnerability Risk Rating

OWASP Top 10CWE
Top 40 Software Errors
CVSSv3CVSS

v2

00 11 22 33 44 55 66 77 88 99 1010InfoScanner ReportedSeverity

Base ScoreLowMediumHigh Critical2Thescore

quantifies

adversarial

riskbyleveraging

providingarich

context

forintelligent

scoring

andstandardized metrics and knowledge gathered by networkprioritization. Additionally, industry-standard sources suchand application scanners, in addition to Ivanti Neurons. Ivantias the NVD (National Vulnerability Database), the 2021 CWE

Neurons is an aggregate of temporal threat intelligence fromTop 40 Most Dangerous Software Errors, and the 2021

over 100 sources, including trending exploit information andOWASP Top 10 are combined with subject matter expertise

Ivanti-identified

from penetration testers to build data-driven models used tothreats.

Thecomprehensive

threatintelligence is then correlated to vulnerability information,

inform the scoring algorithm.

How does Vulnerability Risk Rating differ from other scoring methods?
The CVSS alone cannot provide a complete picture of the risk

Application vulnerabilities are even more challenging toposed by a vulnerability. There is often a lag in which thequantify, with very few being associated with CVEs. In these

NVD can publish a vulnerability and publish a CVSS. Ivantiinstances, we rely instead on CWEs and OWASP, which areNeurons gathers data from CNAs (CVE Numbering Authority)

more appropriate for application weaknesses. Some CWEs

tofromare provided standardized scores, while others are not. VRR

industry-leading security researchers about newly validated

utilizes a combination of scanner information and Ivanti

exploits that are not publicly available. In addition, curated

Neurons to address these inconsistencies and to widen thethreat feeds provide broad coverage and continuous updates

lens on these application weaknesses, building a larger bodyon trending exploits actively being used in the wild. Thisof context for each one. Rather than categorically increasing

gives VRR a superior edge against CVSS due to thebase level scores (resulting in risk inflation), the VRR

correlation of threats as compared to solely severity.

algorithm intelligently separates and elevates the riskiest

bridgethat

gap,alongwithdirect

input

weaknesses, allowing you to prioritize effectively withaccurate and actionable scores.

Vulnerability Count, CVSS V3 vs VRR as of March 9, 2022

3

Why should I consider using Vulnerability Risk Rating?
Ivanti Neurons also leverages existing tools and data, such as

VRR is proactive, dynamic,temporal, and comprehensive.

scanner details, CVSS, and open-source threat intelligence.
However, in instances where no obvious threat is associatedwith the finding, Ivanti Neurons fills that gap by leveraging
industry-endorsed lists, such as the CWE Top 40 Software

VRR provides a unique way to compare finding information

Errors and OWASP Top 10, to provide additional context whenacross infrastructure and applications. Most organizations

calculating risk. To further refine the risk likelihood, Ivanti

typically use either Common Vulnerabilities and Exposures

Neurons cross-correlates CVEs with its threat intelligence to(CVEs) or Common Weakness Enumerations (CWEs) as afurther prioritize findings.

common base. In order to improve vulnerability remediation
strategies, organizations need to accurately measure impact

Organizations require an in-depth, research-driven view ofand determine the likelihood that a vulnerability will bevulnerabilities if they are to prioritize remediation. They canexploited. Ivanti Neurons makes vulnerabilities actionable byuse VRR to optimize the vulnerability management of theirfactoring in threat intelligence and human cognition, giving

network infrastructure and applications.

organizations a thorough understanding of the full context ofeach vulnerability.

Let us take CVE-2017-0144 as an example. This vulnerability is a part of WannaCry and is associated with ransomware. Inaddition, an associated weakness falls on the Top 40 and OWASP Top 10 lists as well. Although the vulnerability has a basescore of High 8.1, Ivanti Neurons factors in its high profile and threat exploits and reclassifies it at a Critical 10.

Ivanti Neurons for

Vulnerability
Knowledege Base*

WannaCry Exploit

CVE-2017-0144

Ransomware
OWASP Top 10 &CWE
Top 40 Software Errors

CVSSv3

VRR Critical:

10High: 8.1

Base Score*Threat intelligence taken on March 9, 2022

4

A couple of other examples of the value added by VRR are captured in the table below:

CVE

CVSS

CVE-2019-0708

9.8

CVE-2021-45105

5.9

CVE-2019-3978

CVE-2020-4430

CVE-2017-0143

7.5

4.3

8.1

Exploit
Yes

Yes

Yes

NoNoCWEOWASPTop 10416

No20306

2220CWE
Top 40Yes

Yes

YesYes

Yes

Yes

Yes

Yes

Yes

VRR

Description

10

This vulnerbility is a part of BlueKeep and not only
has an associated ransomware but also anassociated CWE on the Top 40 list.

7.47

This vulnerbility is a part of Log4j and not only
has an associated DoS, but also an associatedCWE that falls on the OWASP Top 10 list.

8.24

This vulnerbility is a part of Attack Surface – RSwith exploit information available. An associatedweakness that falls under the OWASP Top 10 list
increases VRR but stays within the High band.

6.17

This vulnerbility is a part of CISA Known Exploitedand has no known exploit information available.
However, an associated OWASP Top 10 adds
more context to the picture while staying within
the same band as CVSS.

10This vulnerability is associated to MS17-10 andhas an associated RCE, ransomware, and OWASP.
While NVD scores this vulnerability on the upperband of High, Ivanti Neurons scores it as Criticalbecause there is an associated weakness on theOWASP Top 10 and CWE Top 40.

About Ivanti
Ivanti makes the Everywhere Workplace possible. In the Everywhere Workplace, employees use
myriad devices to access IT networks, applications and data to stay productive as they work fromanywhere. The Ivanti automation platform connects the company’s industry-leading unified
endpoint management, zero trust security and enterprise service management solutions, providing
a single pane of glass for enterprises to self-heal and self-secure devices, and self-service end

ivanti.com
1 800.982.2130
sales@ivanti.com

users. More than 40,000 customers, including 96 of the Fortune 100, have chosen Ivanti to discover,manage, secure and service their IT assets from cloud to edge, and deliver excellent end user
experiences for employees, wherever and however they work. For more information, visit ivanti.com
Copyright © 2022, Ivanti

IVI-2683