tachi-risk-scoring

To convert qualitative threat findings into quantitative risk scores, feed your threat models and category defaults into the risk-scorer. It applies a four-dimensional model across CVSS base, exploitability, scalability, and reachability to generate deterministic composite scores and severity bands.

A four-dimensional risk scoring model evaluates threats across CVSS base, exploitability, scalability, and reachability. This approach transforms qualitative findings into traceable quantitative scores, applying category defaults and governance rules to ensure consistent remediation prioritization.

Yes, you can automate quantitative risk scoring in automated pipelines. The risk-scorer applies deterministic scoring formulas and governance rules to threat findings, consistently deriving governance fields and remediation recommendations without manual intervention.

To calculate a composite risk score from CVSS and reachability data, input your threat findings and category defaults. The risk-scorer uses CVSS 3.1 base vector mappings and composite score formulas to combine exploitability, scalability, and reachability into a final severity band.

Yes, quantitative risk scoring works without external dependencies. The risk-scorer uses internal reference tables for CVSS 3.1 base scoring and governance rules, requiring only your threat findings and category defaults as inputs to generate full risk scores.