What Is a Cyber Risk Score and How Is It Calculated?

Risk in one sentence

Risk combines how likely something bad is and how much harm it would do. NIST's guide to risk assessments (SP 800-30 Rev. 1) describes the result of a risk assessment as a determination of risk that is "typically a function of the degree of harm and likelihood of harm occurring". Every cyber risk score is an attempt to estimate that, with different shortcuts.

Three common ways to calculate a score

Approach	How it works	Good for	Watch out for
Likelihood × impact	Rate each risk scenario, for example 1 to 5 for likelihood and impact, and multiply. The register is summed or shown as a heat map.	Risk registers, ISO 27001 risk assessments, board reporting	Ratings are subjective; agree definitions for each level first
Control-based (inside-out)	Score which security controls are in place, weighted by importance. More controls in place means lower risk.	Fast self-assessment, tracking progress, finding gaps	Measures controls, not threats; a "yes" is only as good as its evidence
Outside-in ratings	A provider scans what is visible from the internet (exposed services, certificates, leaked credentials) and rates the organisation.	Monitoring suppliers at scale	Cannot see internal controls; false positives from shared hosting or old assets

How the ClevSec Cyber Risk Score works

Our free Cyber Risk Score is a control-based score. It asks 15 questions across access, data, systems, detection, response, people, supply chain and governance. Each control has a weight from 4 to 8 points according to how much it reduces risk; multi-factor authentication and encryption weigh most.

"Yes" earns the full weight, "partial" half, "no" nothing.
The score is the points earned as a percentage of the maximum (90 points), from 0 to 100, where higher means lower risk.
80 or more is shown as low risk, 60 to 79 moderate, 40 to 59 high, and below 40 critical, with a breakdown per category.

It takes about two minutes and is meant for a quick first view. For a fuller picture, the Cybersecurity Maturity Assessment covers 39 questions mapped to the NIST Cybersecurity Framework.

Where scores mislead

Self-assessment optimism. People answer "yes" for controls that exist on paper. Score only what you could show evidence for.
Weights are opinions. Any weighting reflects typical risk, not yours. A company holding health data should weigh encryption and access control higher than the default.
A high score is not compliance. NIS2, DORA and GDPR ask for specific measures, documents and reporting that a short score does not test.
Scores hide the worst gap. An 85 with no tested backups is more fragile than the number suggests. Always read the breakdown.

Using a score well

Take a baseline now and write down the evidence behind each "yes".
Fix the highest-weighted "no" answers first: they move both the score and the real risk most.
Re-score every quarter and after major changes, such as a new cloud provider or an incident.
Report the trend and the top three gaps, not just the number.

Get your baseline: the Cyber Risk Score takes two minutes and shows a breakdown by category.

From score to plan. The Cybersecurity Starter Pack turns the gaps into a 90-day security roadmap, with an asset inventory, patch, backup and access review procedures, and a security metrics dashboard.

What Is a Cyber Risk Score and How Is It Calculated?

Risk in one sentence

Three common ways to calculate a score

How the ClevSec Cyber Risk Score works

Where scores mislead

Using a score well

Sources

Related tools

Cyber Risk Score

Cybersecurity Maturity Assessment