Formula & Variables

Where: /dev/org-control/risk-configuration → Dashboard → Click a module card → Formula card and Variables card

When you open a module's detail panel, you'll see two cards under the summary that show how the score was calculated.

Formula Card

Title: "Formula" | Icon: Function icon (blue)

This card shows:

The Formula Expression

A code block displaying the mathematical formula used to compute this module's raw score. For example, for Brand Protection you might see:

(activePhishing*10 + activeDarkWeb*8 + activeLeakedCredentials*8 + activeScams*5 + ...) * (1 - takedownSuccessRate/200)

You don't need to understand the math. The key takeaway is that different threat types have different weights — phishing (×10) is considered more dangerous than counterfeits (×3), for example.

Tip: Click the formula to copy it to your clipboard.

Computation Stats

Below the formula, four stat boxes show:

Stat	What It Means
Raw Input	The total weighted score before normalization — bigger = more risk detected
Scale Factor	Adjusts based on how many total detections the org has (larger orgs need higher raw input to reach the same score)
Risk Score %	The calculated risk percentage (this is inverted to get the health score: health = 100 − risk)
Rule Boost	Extra risk points added by scoring rules (only shown if rules are active)

Variables Card

Title: "Variables" | Icon: Variable icon (purple)

A grid of all the input values that were fed into the formula. Each item shows:

Variable name (left) — e.g., activePhishing, vulnCritical, meanThreatScore
Value (right) — the current count or measurement

Variables with a value greater than zero are highlighted with an amber border to draw attention to active risk factors.

Tip: Click any variable to copy its name and value to your clipboard.

What This Tells You

Which threats are present — Variables with non-zero values show what the module detected
What matters most — The formula weights tell you which threat types have the biggest impact on the score
Why the score changed — If a variable increased since last time, it directly affected the score

Common Variables by Module

Brand Protection (BP):

activePhishing — Active phishing sites targeting the brand
activeDarkWeb — Dark web mentions
activeLeakedCredentials — Leaked credentials found
activeBinLeaks — Payment card BIN leaks
takedownSuccessRate — % of threats that were successfully taken down

Attack Surface Management (ASM):

vulnCritical, vulnHigh, etc. — Vulnerability counts by severity
portExposureCount — Number of exposed ports
subdomainCount — Number of discovered subdomains

General Detection:

urgentCount, criticalCount, etc. — Detection counts by severity
resolutionRate — % of detections that have been resolved