Episode 47

Having one value to summarize risk posture is handy, but not without its caveats. For starters, predictive analyses founded on your risk score are strictly limited by the quality and subjectivity of the data that define it (unless you can see the future), leaving room for skewed prognoses. There's also the fact that a risk score doesn't account for important factors like whether CVEs have actually been exploited, or whether they can actually be remediated in the first place. And lastly, a truth that bears repeating: risk scores are very specifically context-dependent, and more often than not, don't accurately translate between processes, business units or organizations.