What is risk scoring?
The process of calculating a number, or score, to help determine the risk level of a user, device, or entity in the presence of risk factors is called risk scoring. The approach of using a risk-based score helps businesses capture more information about users than they can do with the traditional KYC methods.
A risk scoring system generally has two components, namely: vulnerability characterization and the effect on business operations. It enables businesses to continuously review and monitor consumer activity to assign new risk scores when consumer behavior evolves with changing business dynamics.
Types of risk scores
Risk scores are broadly classified into two types as described below:
- Internal Risk Scores: The scores assigned refer assessment of risks emanating from within the company are called internal risk scores. Often, they are difficult to score as internal risks are usually not identified. Some of the most common internal risks include inadvertent human errors that may cause data leaks, poorly defined roles and responsibilities that result in no accountability, damage and loss of business assets.
- External Risk Scores: Scores assigned to risks emanating externally to the organization are termed external risk scores. External risks can be potentially everything that can threaten business operations. Businesses assess these risks to deploy adequate safety measures in order to protect business and consumer interests. Some of the common external risks include cyberattacks, dynamic economic environment, and natural disasters, among others.
Calculating risk score
Risk identification and risk analysis are two steps before getting down to calculate risk scores. Let us look at each of these components a bit more closely:
- Risk Identification: Risk identification is an ongoing process that begins at the point of entry and continues through the consumer lifecycle. While assessing risks, it is possible that some risks are easy to identify (known risks) while there are some that will need much more effort to uncover.
- Risk Analysis: The next step after risk assessment is to analyze the identified risks and understand the threats they pose to the business. Risk analysis enables businesses to calculate the probability of a threat and its likely impact. These insights inform the decision-making on deploying appropriate countermeasures to mitigate the risks.
Finally, the risk score is calculated by multiplying the risk impact rating with risk probability. However, for dynamic risks, such as Test Case Weight, the assessment score is a function of predefined settings and does not get influenced by the current impact.
Here is a high-level illustration of how a risk score is defined.
| Detection | Anomaly Velocity | Risk Classification |
| 1 anomaly detected | Low | Low |
| Medium | Medium | |
| High | High | |
| 2 anomalies detected | Low | Medium |
| Medium, High | High | |
| 3 anomalies detected | Low, Medium, High | High |
The need for risk scores
Accurate risk scoring is critical to an efficient risk management system as it allows anomaly detection, helps identify risks, and prevent possible operational and reputational damage to the business.
Attackers are improving their attack tactics every single day. To keep up with this evolution of attacks, businesses need advanced detection capabilities. They need ways to evaluate incoming traffic and signals in multiple ways so they can accurately identify various attack vectors. It is possible that a session has multiple attack vectors leading it to be categorized as high risk. When minor anomalies are detected, the session may be categorized as medium risk.
This categorization of risk scores helps eliminate some of the complexity of the detection process as well as apply a response strategy that is proportional to the risk associated. Accurate risk scores help businesses build defense systems that not only help protect the business from multiple threats but also minimize the damage to consumers’ account security in case of an adverse incident.