Deployment: Invicti Platform on-demand, Invicti Platform on-premises
Introduction to Predictive risk scoring
This document provides an overview of how Predictive risk scoring in Invicti Platform works and why you should use it. For instructions on enabling and using risk scores, refer to the Utilize predictive risk scoring document.
What is Predictive risk scoring
Predictive risk scoring augments the application scanning process by helping you prioritize your web assets prior to scanning. It uses AI to calculate risk scores compiled from up to 220 data points that predict the highest severity vulnerability of each discovered website with a minimum 83% confidence level. The assigned risk scores then give you the means to rank your sites and gauge the overall potential risk of your web assets before you scan them. Using this information, you can focus on scanning and fixing your riskiest sites first to make your web assets and organization safer.
Why this matters
Discovering hundreds or thousands of web assets is useful only if you can act on the results. Without prioritization, you're as likely to scan a low-risk site first as a critical one. Predictive risk scoring lets you rank assets by vulnerability likelihood before committing scan resources to them, so you can reach your riskiest exposures faster and reduce the time between discovery and remediation.
How Predictive risk scoring works
Predictive risk scoring uses AI developed, maintained, and trained in-house by the Invicti AI Engineering team. It uses a machine learning model for prediction based on the findings of Website discovery. Predictive risk scoring then visits those web assets (without scanning them) and uses publicly available attributes to calculate risk score predictions.
The risk score model was trained by scanning a large number (150,000+) of websites that are part of Bug Bounty and/or VDP (Vulnerability Disclosure Program) programs. From each of these websites, Invicti extracted 220 data points correlated with the security posture of the website.
A few examples of the 220 data points:
- The website supports deprecated TLS versions like TLS v1.0
- The copyright year of the website (older websites tend to be more vulnerable)
- Number of form inputs
- Number of XHR requests
- Number of cookies not marked as HttpOnly/Secure
"With Predictive risk scoring, we don't use an LLM and also don't send any requests to an external AI service provider. Our machine learning model is explainable and deterministic. It is also not trained on any customer data. Because it doesn't process any natural language instructions like an LLM, there is no risk of prompt injections and similar attacks." - Bogdan Calin, Invicti's Principal Security Researcher and the main creator of Predictive risk scoring.
For a deeper dive into the technical side of Predictive risk scoring, read the blog post Why Predictive risk scoring is the smart way to do AI application security.
Risk score overview
The risk score indicates how likely a website is to have vulnerabilities. Risk scores are only available for assets discovered through Website discovery - not for targets you add manually.
| Risk score | What it means |
|---|---|
| Critical | Predicted to have at least one critical severity vulnerability. |
| High | Predicted to have at least one high severity vulnerability. |
| Medium | Predicted to have at least one medium severity vulnerability. |
| Low | Predicted to have at least one low severity vulnerability. |
| Undetermined | Invicti can't calculate a confident risk score for this site. |
An Undetermined result means the site is on an internal network, doesn't provide enough publicly available information to calculate a score, or has a security tool blocking access. For help, see A web asset shows "Undetermined" instead of a risk score.
Even sites with a low risk score can have critical vulnerabilities not predicted by the model. The risk score gives you insight into the likely vulnerability of your web assets to help you make an informed decision about which sites to scan immediately and which sites can be scanned next. You still need to scan your sites to find actual vulnerabilities.
Manage Predictive risk scoring
Predictive risk scoring is controlled from Settings > AI, accessible to users with the Owner role. For information on enabling the feature, refer to the Enable AI features document.
View and filter risk scores
Risk scores appear automatically on the Website discovery page once Predictive risk scoring is turned on. The Discovery service refreshes daily - when Invicti discovers a new web asset, it automatically provides a risk score (assuming the web asset is reachable). For step-by-step instructions on filtering, sorting, and acting on risk scores, refer to the Utilize predictive risk scoring document.
Turn off Predictive risk scoring
- Select Settings > AI from the left-side menu.
- Under Features, set Enable Predictive risk scoring in Discovery to No.
- Click Save changes.
When you turn off Predictive risk scoring, the risk score column disappears from the Website discovery page immediately. Your discovery data is unaffected, and existing scores are retained.
When you turn the feature back on, previously scored assets show their scores immediately. Assets discovered while the feature was off show Scoring Queued while awaiting calculation. To speed up scoring, select assets and use Bulk actions > Refresh risk.
Troubleshooting
Risk scores aren't appearing for my discovered websites
Predictive risk scoring runs as part of Discovery and may take a few minutes after enabling. If scores still don't appear, confirm that the feature is turned on under Settings > AI and that Discovery is actively running.
If you can't see the Settings menu at all, your account doesn't have the Owner role. Contact your account owner to enable Predictive risk scoring.
A web asset shows "Undetermined" instead of a risk score
An Undetermined label means Invicti couldn't calculate a confident risk score. The most common causes are:
- The site is on an internal network and isn't reachable from the Discovery service.
- The site doesn't provide enough information to calculate a score.
- A security tool on the site is blocking access to the required information.
If the site is external and accessible, use Bulk actions > Refresh risk to request a new calculation.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center