> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md). # Risk Factors Cortex Xpanse uses the set of Risk Factors described below when calculating risk scores. Risk Factors are associated with alerts, so an incident (which is a collection of alerts) will have one or more risk factors. You can view the risk factors associated with an incident on the **Risk** tab of the incident details pane. The following table provides a brief description of each of the risk factors that can impact a risk score. | Risk Factor | Brief Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------- | | Critical System | High value systems such as ICS/SCADA, Domain Controllers, Medical Systems. | | EOL System | Any product that is End-of-Life or has EOL/legacy versions. | | Exposed Login | Any product where unintentional exposure of a login portal or authentication system is likely. | | Informational | Any product that we don't find inherently risky. | | IoT System | Physical asset products such as surveillance cameras or embedded systems. | | Misconfiguration | Any product where there's a significant risk of unintentional misconfiguration. | | No Cryptography | Any service where no cryptography is implemented (i.e. unencrypted logins). | | Potential Data Loss | Any product where unintentional exposure of non-public data or storage locations is likely. | | Privileged Access | Any product that can be used to manage or administer computational resources. | | Remote Access | Any product that enables remote access into a network. | | Vulnerable | Any product/service/protocol for which a CVE exists or that we deem to be risky most of the time (for example, RDP). | | Weak Cryptography | Any product that implements cryptography that is easy to exploit. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.