WRT
How the risk of a product is counted, and how to set the risk you accept.
WRT (weighted risk trend) is one number for the risk that a product carries. It grows with the number and severity of its open findings and with the product’s business criticality, so you can compare products and follow a product over time without reading its findings.
How it’s counted
Each open finding adds its severity weight. The sum is multiplied by the product’s business criticality, as a share of 100:
WRT = (critical × 50 + high × 25 + medium × 10 + low × 5) × business criticality / 100
The numbers are the default severity weights. For example, a product with 2 critical and 4 high findings and a business criticality of 60 has a WRT of (2 × 50 + 4 × 25) × 0.6 = 120.
A new product has a business criticality of 100, so its findings count in full until you assess it. Set the criticality of every product, or all of them weigh as the most critical and the comparison between products tells you little. A business criticality of 0 gives a WRT of 0 whatever the findings.
Risk appetite
The risk appetite (RA) is the WRT you accept. WRT to RA on the product cards and the dashboard is WRT as a share of the risk appetite: above 100%, a product carries more risk than you accept.
There are two values:
- Product risk appetite, for each product. A good start is the weight of one critical finding (50 by default): a critical product may then have one open critical finding.
- General risk appetite, for the dashboard, which adds up all products. A good start is the product value multiplied by the number of products. The settings page shows this value for your products.
Settings
Open the settings, then WRT Settings under Metrics Configuration:
| Setting | Default |
|---|---|
| Statuses participating in WRT calculation: the triage statuses whose findings count. They count in the dashboard counters too. | Verified, Assigned |
| Severity Weights: how much one finding of each severity adds | critical 50, high 25, medium 10, low 5 |
| The General risk appetite and The Product risk appetite | 1 |
Counting Unverified findings too shows the risk before triage, but scanner noise inflates it.
Change the risk appetite from its default of 1 first: until you do, every product with a finding is far above 100%.