A common ESCU methodology calculates risk as:
Risk Score = Impact × Confidence / 100
Impact represents the potential significance or consequence of the detected behavior, while confidence represents how strongly the analytic supports the conclusion that the activity is security-relevant. Dividing by 100 normalizes the confidence percentage when combining the two values.
For example, if a detection has an impact value of 80 and confidence of 75%, the resulting score is:
80 × 75 / 100 = 60
This methodology prevents a high-impact but low-confidence analytic from automatically producing the same risk contribution as a high-impact, high-confidence detection. It therefore supports Risk-Based Alerting by allowing individual detections to contribute proportional evidence to a user, host, or other risk object.
Risk-object priority or severity can still influence downstream prioritization through contextual enrichment and Risk Factors, but those concepts are distinct from this ESCU risk-score calculation. The supplied Cybersecurity Defense Engineer material separately reinforces the role of risk scores, Risk Factors, and contextual prioritization in Enterprise Security.
Study Guide topics: ESCU, Risk Analysis adaptive response action, risk score, impact, confidence, Risk-Based Alerting, risk objects.
