Risk Assessment
Risk Assessment runs a security scanning engine against your synchronized AWS assets to identify risk factors for each asset.
The entire flow — initiating a scan, viewing history, reviewing a results summary, and drilling down into per-asset analysis — is available on a single page.
New Scan runs against the most recently synchronized assets.
By default, a scan runs when you press New Scan. There is no continuous monitoring or real-time threat detection - results describe the account as it was at the moment the scan ran.
You can also set up a schedule per connection, from the Scheduled Runs tab in Project Settings, to run a scan (or a sync, or IAM analysis) automatically on a recurring interval - daily, weekly, monthly, or quarterly. Scheduled runs are recorded in the Run History just like manual ones. This is not continuous monitoring in the sense of something always running - it is a schedule that turns a run on at set times.
Risk assessments are run from the Compliance Check page in the left menu. The page is organized into the following sections:
- Scan Control – Start a new scan and view the latest results summary
- Scan History – Records of previous scan runs
- Scan Results – Risk assessment results per asset
- Problems – A list that tracks the same problem as one row across scans and records the decision made about it (see 6. Problems)
- Compare – A comparison screen showing what changed between two scans (see 7. Scan comparison)
1. Running a Scan & Scan History
1.1. Running a New Scan
To run a risk assessment:
- Click the New Scan button at the top.
- The scan starts against your most recently synchronized assets.
- Once complete, results appear in the Scan Results section.
1.2. Latest Scan Summary Card
The top card shows you the results of the most recent scan at a glance.
- Scan ID
- Execution status (Finished / Success, etc.)
- Scan duration
- Number of assets at risk
- View Detailed Report button to navigate to the detailed results page
1.3. Scan History
Review results by Scan ID in the history table at the bottom.
- Started / Finished timestamps
- Status
- View Overview: See the risk distribution summary for that scan
- Compare: Compare with another scan (see 7. Scan comparison). Only available on finished scans.
Scan statuses
| Status | Meaning |
|---|---|
Pending / Running | Queued, or currently running |
SUCCESS | Finished normally; results are in Scan Results (shown as Completed in the dashboard's Assessment History) |
Failed | The scan did not finish (credential error, scanner error, or the time limit was exceeded) |
CANCELLED | You stopped it |
Failed and CANCELLED are different. CANCELLED means you stopped the run; Failed means the product or the scanner could not finish it.
A single scan has a time limit (60 minutes by default). Past that, the scan process is terminated, the run is recorded as Failed, and the reason is kept with it. Partial results are not stored, so the scan has to be run again. If runs repeatedly hit the limit, reduce the scope under Assets → Synchronization → Sync Scope.
2. Scan Results (Detailed Results)
2.1. Top Risk Summary
The top of the scan results page shows the following metrics:
- Total Assets at Risk: Total number of assets evaluated as having risks
- Asset counts by risk level:
Very High,High,Moderate,Low,Very Low
Risk levels are calculated by combining an asset's vulnerabilities, attack likelihood, and potential impact.
- Very High – Critical security risk requiring immediate action
- High – Security issue with high attack potential
- Moderate – Potential security risk
- Low – Risk with limited impact
- Very Low – Low risk level
2.2. Asset List & Detail Panel
- Left side: List of at-risk assets (with search and risk level tab filters)
- Right side: Detailed results for the selected asset
- The right-side detail panel has three tabs: Overview / Findings / Details
3. Overview Tab
The Overview tab shows a summary of the risk assessment for the selected asset.
3.1. Radar Chart Metrics
The Radar Chart visualizes the key metrics used to calculate the Overall Risk Level.
- Techniques: Number of MITRE ATT&CK techniques linked to the checks that failed
- CVEs: Number of CVEs linked to those techniques
- Avg EPSS: Average EPSS (exploit prediction) score of those CVEs
- Severity: Asset severity level
- Controls: Number of related security controls
This product does not perform vulnerability (CVE) scanning. The CVE count is not the number of vulnerabilities found on the asset; it is the number of CVEs that public mapping data associates with the ATT&CK techniques behind the failed checks. It does not mean those CVEs are present on this asset, and the EPSS average should be read only as a relative signal of how often that technique is exploited in the wild. Checking operating systems, packages or container images for vulnerabilities requires a dedicated vulnerability scanner.
3.2. Overall Risk Level
Overall Risk Level is calculated based on NIST SP 800-30.
Risk = Likelihood × Impact- Likelihood: The probability of a risk occurring
- Impact: The impact if it does occur
This formula is a registered, versioned definition, and each finding's detail view shows the basis for which bin and mapping it went through to reach its risk level. For criteria your organization can set differently (EPSS bins, the unused-credential threshold, and so on), and how a formula-version change is marked on the trend chart, see Risk Score Explained.
4. Findings Tab
The Findings tab shows whether security checks applicable to the asset have passed or failed.
- PASS: Check passed
- FAIL: Check failed
- Click View Documentation on each item to see the corresponding remediation guide
5. Details Tab
The Details tab presents risk items in a detailed table.
- Threat
- MITRE ATT&CK Technique
- CVEs (linked as described in 3.1)
- Avg EPSS
- Check Title
- Severity
- Recommendation
NIST SP 800-53 Requirements are also displayed at the bottom of the page.
- These are the security control items that the asset is expected to comply with.
6. Problems
The Findings tab and Scan Results show "what did this scan see." The Problems screen shows "what is wrong with this account, and since when." If the same check fails on the same resource across ten scans, that is ten findings but one row in Problems, shown with the date it was first seen and the date it was last seen. Each problem is identified by the combination of account, region, resource and check.
Open it with the Problems button at the top right of the Compliance Check page.
6.1. The list
Two rows of filters sit above the list. You can select several values at once; with nothing selected, everything is shown.
- State – filter by state. Each button also shows the number of problems in that state.
- Severity –
Critical,High,Medium,Low,Informational - Refresh – reloads the list.
| Column | Content |
|---|---|
Check | The check ID. Click it to open that problem's detail page. If the problem has reappeared after being fixed, came back N times is shown below it. |
Resource | The affected resource |
Severity | Severity |
State | Current state (see the table below) |
Owner | Owner |
Due | Remediation due date. Shown in red once it has passed. |
Age | Days since the problem was first seen |
Last seen | The date a scan last saw it |
The list shows 25 per page; use Newer / Older to page through. If nothing matches, Nothing matches. A problem appears here once a scan has seen it. is shown — a problem only appears in this list once a scan has seen it at least once.
States
| Shown as | Meaning |
|---|---|
Open | Seen in the most recent scan and not yet decided on |
Came back | Was fixed, then showed up again |
Accepted | Knowingly carried until a set date (accepted risk) |
Suppressed | Judged not worth reporting and kept out of the counts until reopened |
Fixed | Gone from the scan, or marked fixed by hand |
Superseded | Disappeared because the scanner changed between two scans. Its disappearance is not proof that it was fixed. |
6.2. Problem detail
Clicking a Check in the list opens the detail page for that one problem. The title is the check ID, with the affected resource below it.
The Where and since when card shows State, Severity, Account, Region, First seen, Last seen, Age, Came back (how many times it reappeared), Fixed at, Owner, Due, Accepted until, Control and Identity, followed by a one-line explanation of the current state.
The Every time a scan saw this table lists the scans that saw this problem, oldest first (Seen, Scan, Severity, Outcome, Title). A gap means a scan ran in between and did not see the problem. Clicking a Scan ID opens that scan's results, and items with known real-world exploitation are marked known exploited.
6.3. Deciding (Decide)
Use the Decide panel on the right to change a problem's state and ownership details.
- State – only the states reachable from the current one are offered. The current state is shown as
(leave as is). - Owner – who is fixing it
- Due date – remediation due date
- Accepted until – the date an acceptance runs out. It is required when changing to
Accepted. Once this date passes, the acceptance ends and the problem reopens by itself. - Reason – why it is being accepted or suppressed
- Note – anything the next reader of this problem should know
Clicking Save stores only the fields that changed. If nothing changed, Nothing changed. is shown.
| Current state | States you can set by hand |
|---|---|
Open, Came back | Accepted, Suppressed, Fixed |
Accepted, Suppressed | Open |
Fixed, Superseded | Cannot be changed by hand — decided by the next scan |
If the server refuses a state change, its reason is shown word for word above the Decide panel.
A problem marked Accepted or Suppressed is not reported as new when the next scan sees it again. Because it carries a decision, an owner and a date, the "open problems" count comes to mean the number of things that actually need work.
Read-only users (Viewers) and auditors can see the detail page, but the Decide panel's fields and the Save button are disabled.
7. Scan comparison
Compare what appeared and what disappeared between two scans.
- In Scan History, click Compare on the first scan. The button changes to
Pickedand a notice appears above the list:Comparing from <scan ID>. Pick a second scan to compare it with.Click Cancel to back out. - Click Compare on the second scan to open the Scan comparison screen. Whichever you picked first, the earlier scan is the baseline and the later scan is compared against it.
Compare is only available on finished scans.
The top of the screen summarizes the result in one line (for example, 3 new, 1 gone; 12 still there.), and five cards below show the count for each group. Click a card to list that group's problems below (Check, Resource, Severity, State, First seen, Last seen). Clicking a Check takes you straight to the problem detail page, so you can assign an owner to a new problem on the spot.
| Card | Meaning |
|---|---|
New | Seen for the first time in the later scan |
Came back | Absent at the earlier scan and back in the later one |
Still there | Present in both scans |
Gone | Present in the earlier scan and not in the later one |
Superseded | Gone from the later scan, but the scanner changed in between, so it is not proof of a fix |
If the two scans ran on different scanner versions, the warning The scanner changed between these runs (...) is shown. Problems that disappeared may have been dropped from the scanner's checks rather than fixed, so they are classified as Superseded instead of Gone. For how the trend chart marks the same point, see Trend and formula breaks in Risk Score Explained.
8. Operational Tips
- Run repeated scans against the latest synchronized assets to track risk trends over time (if you need regular runs, schedule them in Scheduled Runs)
- Use Scan History to quickly compare status and results across scans, and use Compare to see what changed between two scans
- Use the Overview to understand risk levels, then drill into Findings/Details for immediate root cause analysis and remediation
- In Problems, set owners and due dates, and accept problems you will not fix right away with an expiry date, so the open-problem count stays a true measure of work to do