Threat Score

When signal reports are received into the GSE we calculate and update a threat score for the signal. Based on these threat scores we can create average threat scores for groups and the GSE as a whole.

As the threat score is largely a measure of activity detected within the GSE, a reduction in the average threat score over time is a good indication that action is being taken to address signals of abuse.

Whilst we don’t publish the full details of the algorithm in use for the threat score, the score is affected by the following key factors:

• Vendor supplied confidence score - this is used to provide the initial threat score when a new report is received for a signal and has an ongoing minor impact on the threat score.
• Enrichment data produced by the GSE - Enrichment data supplied as feedback enrichment reports may be used to identify supply chain actors for signals. Based on league tables we produce for these supply chain components we can make an adjustment to the threat score based on the numbers of reports we have seen for these elements.
• Action Feedback reports - These are sent by users of the GSE to indicate that action has been taken on signals. Action reports discount the threat score for a signal as they represent a reduction in threat.