> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md). # Risk Factors Cortex Xpanse uses a set of Risk Factors when calculating incident risk scores. Cortex Xpanse uses the set of Risk Factors described below when calculating risk scores. Risk Factors are associated with alerts, so an incident (which is a collection of alerts) will have one or more risk factors. You can view the risk factors associated with an incident on the **Risk** tab of the incident details pane. The following table provides a brief description of each of the risk factors that can impact a risk score. | Risk Factor | Brief Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------- | | Critical System | High value systems such as ICS/SCADA, Domain Controllers, Medical Systems. | | EOL System | Any product that is End-of-Life or has EOL/legacy versions. | | Exposed Login | Any product where unintentional exposure of a login portal or authentication system is likely. | | Informational | Any product that we don't find inherently risky. | | IoT System | Physical asset products such as surveillance cameras or embedded systems. | | Misconfiguration | Any product where there's a significant risk of unintentional misconfiguration. | | No Cryptography | Any service where no cryptography is implemented (i.e. unencrypted logins). | | Potential Data Loss | Any product where unintentional exposure of non-public data or storage locations is likely. | | Privileged Access | Any product that can be used to manage or administer computational resources. | | Remote Access | Any product that enables remote access into a network. | | Vulnerable | Any product/service/protocol for which a CVE exists or that we deem to be risky most of the time (for example, RDP). | | Weak Cryptography | Any product that implements cryptography that is easy to exploit. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.