UNCLASSIFIED - NO CUI

Skip to content

Investigate heatmap view for controls

Summary

Current risk assessment uses broken hardcoded thresholds:

  • hardcoded values
  • Warnings over-penalize small datasets
  • No context for namespace size

Solution

Replace with volume-aware algorithm:

Risk Logic

  • Small (≤10 checks): 1-2 fails = Low, 4+ fails = High
  • Medium (11-50 checks): ≤2 fails + ≤15% rate = Low, ≤7 fails + ≤35% rate = Medium
  • Large (50+ checks): Use statistical percentiles from dataset

Weight Formula

Failures × 5 + Warnings × 0.5 (warnings much less impactful)

Acceptance Criteria

  • calculates risk score relative to volume size
  • Use only latest scan data per source
  • Handle empty datasets gracefully

example

Input Current Expected
2 pass, 1 fail High Low
10 pass, 20 warn, 0 fail Medium Safe
50 pass, 25 fail High High
Edited by Manuel Ucles