Contrast Score
The Northstar release uses a sophisticated scoring mechanism to provide a quantifiable and actionable measure of application risk. The score is not a single static number, Instead, Contrast derives the score from a multi-layered analysis that takes business, threat, and architectural contexts into consideration.
The Contrast Score uses CVSS v4.0 as its basic framework but then enriches that base score in real time with details from running software in production. Contrast Scores incorporate technical, architectural, threat, and business contexts from the Contrast Graph.
This approach provides a more accurate and realistic assessment of an application's security posture.
Contrast Score benefits
User | Benefits |
|---|---|
SOC analysts | Drastic reduction in noise: AppSec teams are often overwhelmed by long lists of vulnerabilities from static scanners. The Contrast Score filters out the noise by lowering the priority for vulnerabilities that are not reachable or exploitable in the application's current runtime environment. This information eliminates distractions from false positives and allows the team to focus on what is most important. Accelerated remediation (MTTR): By providing a clear, prioritized list of the most critical and exploitable vulnerabilities, developers can fix the most dangerous issues first. This information significantly reduces the Mean Time to Remediate (MTTR) and improves the application's security posture more quickly. Data-driven justification: The clear scoring methodology provides AppSec teams with the data needed to justify resource allocation and explain the importance of fixing specific vulnerabilities to development teams and management. |
AppSec teams | Contextualized alerts: When Contrast detects a potential attack, the Contrast Score provides immediate context about the vulnerability being targeted. An alert on a vulnerability with a high risk score and confirmed exploitability is instantly understood to be more critical than a probe for a low-score, non-exploitable flaw. Improved triage and incident response: During an incident, the SOC analyst can use the score to understand the inherent risk of the application being targeted. This information helps the to prioritize their responses, letting them focus on applications with poor scores and a higher likelihood of containing other exploitable weaknesses. Enhanced threat hunting: SOC analysts can proactively hunt for threats by focusing on applications with low scores. This information lets them focus on searching for indicators of compromise related to the most likely and dangerous attack vectors targeting their specific application portfolio. |