A risk score is a numeric rating used to rank security findings by how much concern they may deserve. Security tools often compute it from factors such as exploitability, asset value, exposure, and known vulnerabilities. The goal is not to prove that one issue is “good” or “bad,” but to help teams prioritize limited time and response effort.
In cyber security, risk scores are useful for triage and reporting, especially when defenders must compare thousands of alerts or assets. They matter because attackers do not exploit every weakness equally; a reachable, high-value system usually deserves attention before a low-impact one. However, a score is only as good as its inputs. If data is stale, incomplete, or poorly weighted, the number can hide real danger. Strong defense uses risk scores as a starting point, then adds context, asset criticality, and human review before action.