Overview
Risk factors are the individual security, compliance, and operational checks used to evaluate endpoint health and calculate policy scores. Each risk factor is measured by one or more probes running on managed endpoints. When a policy is assigned to an endpoint and the endpoint comes online, the platform automatically delivers the required risk factor definitions to the device. The endpoint then performs the necessary checks and reports probe results back at defined intervals. Risk factors may be shared across multiple policies. In such cases, the endpoint performs the check only once and the result is reused wherever the risk factor is referenced.Risk Factors
A risk factor represents a measurable condition, configuration, behavior, or event that may increase organizational risk. Examples include:- Missing operating system updates
- Disabled firewall protection
- Disabled disk encryption
- Suspicious authentication events
- AI tool access
- USB device usage
- Excessive resource consumption
- Disk or storage errors
Types of Risk Factors
Event-Based Risk Factors
Event-based risk factors are triggered by activities occurring on the endpoint rather than its current configuration. Examples include:- Process executions
- AI tool access
- USB device activity
- Security events
- Disk I/O errors
- Resource consumption
If the endpoint is offline, the event-based risk factor value will not change in the Portal until the endpoint get online and new probe values are obtained.
State-Based Risk Factors
State-based risk factors evaluate the current configuration or condition of an endpoint. Examples include:- Firewall status
- BitLocker status
- Antivirus configuration
- Operating system update status
- Secure Boot configuration
Probes
A probe is the technical mechanism responsible for collecting information about a specific risk factor. Each probe performs a defined check on the endpoint and returns a result representing the current level of risk. Examples of probe activities include:- Checking whether BitLocker is enabled
- Verifying firewall configuration
- Detecting suspicious processes
- Monitoring endpoint performance metrics
- Evaluating operating system security settings
Probe Values
Each probe returns a value between:- 0: No risk detected
- 100: Critical risk detected
Risk Score Calculation
The risk value of a risk factor is calculated using the following formula:- Probe Value = value reported by the endpoint (0–100)
- Risk Factor Severity = policy-specific weighting (0–1)
Example
Risk Levels
Risk values are classified into four categories:
For display purposes, values are rounded to the nearest whole percentage.
Risk Factor Statuses
Risk factors can exist in one of six statuses throughout their lifecycle.Active
The risk factor has a score greater than 0 after previously being 0 or Unknown. Active risk factors indicate a currently detected issue that may require investigation or remediation.Remediated
The state-based risk factor score has returned to 0 after previously having a non-zero value. This status indicates that the underlying issue has been resolved.No Longer Relevant
Primarily used for event-based risk factors. When an event-based risk factor automatically resets to 0 (for example, during the daily reset at midnight), it is marked as No Longer Relevant because the triggering activity is no longer considered current.No Evidence Found
The risk factor has never returned a value greater than 0. This status indicates that no evidence of the monitored condition has ever been detected on the endpoint.Not Applicable
The risk factor cannot be evaluated because the endpoint operating system or environment does not support the required check.Unknown
The risk factor is not currently being evaluated on the endpoint. This typically occurs when:- The endpoint has not yet completed the check
- Required telemetry is unavailable, but the factor cannot be considered not applicable
- Communication with the endpoint is incomplete
- The probe has not yet been executed
Efficiency and Optimization
To minimize endpoint overhead, the platform evaluates each risk factor only once per endpoint, regardless of how many policies reference it. When multiple assigned policies use the same risk factor:- The probe executes only once.
- The result is shared across all applicable policies.
- Each policy applies its own severity weighting.
- Different policies may therefore calculate different risk values from the same probe result.
Key Considerations
- Risk factors provide the evidence used to measure endpoint health, policy compliance, and overall security posture.
- Prioritizing high-risk and high-severity risk factors helps focus remediation efforts where they will have the greatest impact.
- Event-based risk factors help identify risky activities and behaviors, while state-based risk factors highlight configuration weaknesses.
- Probe results are collected once and reused across policies, ensuring efficient monitoring without unnecessary endpoint overhead.
- Technical details returned by probes support faster root-cause analysis and more effective remediation.
- Continuous monitoring enables security teams to detect emerging risks, validate remediation efforts, and track improvements over time.
Related
Risk factors page
Explore all risk factors defined across system policies to understand their usage, detection history, associated controls, and impact on managed endpoints.
Risk factor details
View detailed information about a risk factor, including its detection history, affected endpoints, associated policies and controls, and more.
Remediation and recommendations
View detailed remediation instructions and security recommendations for each risk factor to help resolve identified issues and reduce future risk.
How to investigate risk factors
Investigate risk factors affecting an endpoint, review available technical details, and understand the underlying conditions or activities that caused a risk to be detected.