---
title: "Risk Score Indicators - Detailed"
canonical: "https://kb.cynergy.app/space/GS/913080324/Risk%20Score%20Indicators%20-%20Detailed"
format: markdown
---
| **Issue** | **Indicator Type** | **Weight** | **Mitigation** | **Automated Remediation** | **SLA** |
| --- | --- | --- | --- | --- | --- |
| High Severity Vulnerabilities identified | Application Security | High | Solve the identified issue<br>Update the related CMS or Plugin | Possible requires integration | 10 Days |
| Website without HTTPS | Application Security | High | Serve the site over secure protocols | Possible requires integration | 30 days |
| The website is not protected by WAF | Application Security | High | Move website behind WAF | Possible requires integration | 5 days |
| Medium Severity CMS Vulnerability identified | Application Security | Medium | Solve the identified issue<br>Update the related CMS or Plugin | Possible requires integration | 30 days |
| A website without HSTS Best Practice | Application Security | Medium | Set an HSTS header | Possible requires integration | 10 days |
| A website without X-Frame-Options Header | Application Security | Medium | Set X-Frame-Options Header with `"DENY",` or `"Allow-FROM",` Directive | Possible requires integration | 60 days |
| A website without an X-Xss-Protection header | Application Security | Medium | Set X-Xss-Protection header with `"1; mode=block"` | Possible requires integration | 60 Days |
| Low Severity CMS Vulnerability Identified | Application Security | Low | Update the related CMS or Plugin | Possible requires integration | 60 days |
| A website without a Content-Security-Policy Directive set | Application Security | Low | Set a Content-Security-Policy header as `"upgrade-insecure-requests"` | Possible requires integration | 60 days |
| SPF Misconfiguration | SMTP Security | Medium | Set SPF record correctly based on best practices.  
Verify there is only one SPF record set for the domain<br>Set hardfail for emails<br>Set all the approved email senders | Possible requires integration | 30 days |
| DKIM Misconfiguration | SMTP Security | Medium | Set DKIM Records in the Mail server and DNS provider | Possible requires integration | 30 days |
| DMARC Misconfiguration | SMTP Security | Low | Set DMARC at your email provider | Possible requires integration | 30 days |
| MongoDB Service Is Exposed | Service Security | High | Block public access | Possible requires integration | 5 day |
| SSH is exposed and supports vulnerable protocols and authentication methods | Service Security | High | Configure support to SSH version 2 or higher<br>Implement certificate-based authentication | None | 5 day |
| Elastic-Search port exposed | Service Security | High | Block ES public access | Possible requires integration with WAF or FW | 5 day |
| CouchDB, Cassandra DB, MySQL DB, MS SQL Exposure | Service Security | High | Block public access | Potential requires integration with WAF or FW | 5 day |
| RDP port exposed | Service Security | High | Block public access | Potential requires integration with WAF or FW | 5 day |
| SMB Service Exposed | Service Security | Medium | Block public access | Potential requires integration with WAF or FW | 5 days |
| Open FTP Port Exposed | Service Security | Medium | Block public access | Potential requires integration with WAF or FW | 5 days |
| Open Telnet port exposed | Service Security | Medium | Block public access | Potential requires integration with WAF or FW | 5 days |
| Credential leak identified and validated | Validated Compromised Credentials | High | Block public access | Automatic client notification  Password reset requires integration with ADFS or SSO | 1 day |
| Critical severity CVE identified | Technology | EPSS Based | Patch the system, update the vulnerable library to the best known stable fixed version | Possible requires integration with patching tools | 1 day |
| High severity CVE identified | Technology | EPSS Based | Patch the system, update the vulnerable library to the best known stable fixed version | Possible requires integration with patching tools | 5 day |
| Medium Severity CVE identified | Technology | EPSS Based | Patch the system, update the vulnerable library to the best known stable fixed version | Possible requires integration with patching tools | 30 days |
| Low Severity CVE identified | Technology | EPSS Based | Patch the system, update the vulnerable library to the best known stable fixed version | Possible requires integration with patching tools | 90 days |
| Hijacable Subdomain detected | Subdomain Hijacking | High | Delete or correct misconfigured CNAME DNS entry | Automated mitigation subdomain takeover. Automated remediation requires integration with a DNS provider or WAF | 1 day |
| Leaked API Key | Sensitive information Leak | High | Revoke the API key, and remove the published source. | Automated takedown | 30 days |
| Exposed Bucket or Blob with arbitrary read functionality  detected | Cloud Security | High | Change bucket access privilege configuration | Automated remediation requires integration with CSP | 71 day |
| Exposed Bucket or Blob with arbitrary read and write functionality detected | Cloud Security | High | Change bucket access privilege configuration | Automated remediation requires integration with CSP | 1 day |


**Indicators Overall Waight**

| **Indicator Type** | **Components** | **Component individual Weight** | **Overall Weight** |
| --- | --- | --- | --- |
| Infrastructure Security | Service Security | 37.5% | 40% |
| DNS Security | 12.5% |
| SMTP Security | 32.5% |
| Subdomain Hijacking | 17.5% |
| Application Security | 3rd  Party Technology Security | 33% | 15% |
| Misconfigurations | 33% |
| WAF Protection | 33% |
| Sensitive Information Leak | Data Leaks | 100% | 10% |
| Compromised Employee Credentials Identified | Validated Compromised Credentials | 100% | 20% |
| Cloud Security | Misconfigured Storage | 100% | 15% |