---
title: "Risk assessment"
description: "Set a product's business criticality with the risk assessment questionnaire or by hand."
url: https://whitespots.io/docs/appsec-portal/products-and-assets/risk-assessment
slug: appsec-portal/products-and-assets/risk-assessment
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---
# Risk assessment
Business criticality says how much damage an attack on a product would do, from 0 to 100.
Portal multiplies the product's risk by it, so the same findings weigh more
in a critical product. See [WRT](https://whitespots.io/docs/appsec-portal/track-risk/wrt).
A new product starts at 100: until someone assesses it, Portal treats it as
the most critical. Set its criticality with the questionnaire, or by hand.
## Answer the questionnaire
Open the product and click **Risk Assessment** in the sidebar. Answer each question: every answer
has a score from 0 to 90, shown next to it.
Even the most critical answers give at most 90, not 100. A product whose risks you have assessed
is a little less risky than one that nobody has looked at, which keeps the 100 it started with.
The questions below come with Portal and suit most products. An administrator
can replace them, their answers and scores with your own in the admin panel. The default
questions ask:
1. How much the product affects the company revenue.
2. How bad a day of downtime would be.
3. What users can do in it: read or edit data, sensitive or not, or start paid actions.
4. Whether it integrates with internal services, and what those integrations can reach.
5. The same for external services.
6. Which scenarios the product owners fear most.
7. What data it stores.
8. Whether it contains financial logic.
The business criticality is the average score of all questions, rounded to 10. A question
without an answer counts as 0. Click **Submit** to save the answers and set the criticality.
Answer together with the product owner: they know the business impact better than the security
team.
## Set it by hand
On the product's page, click a value on the **Business Criticality** scale.
Portal offers to **Take the test** instead; click **Set manually** to keep the
value you clicked.
The date under the scale shows when the criticality last changed.
---
## Navigation
- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Products and assets](https://whitespots.io/docs/appsec-portal/products-and-assets)
- Previous: [Assets](https://whitespots.io/docs/appsec-portal/products-and-assets/assets)
- Next: [Find vulnerabilities](https://whitespots.io/docs/appsec-portal/find-vulnerabilities)