Hi,
I was confused with the risk score calculation for VIT. There are default risk rule is defined to calculate Risk score. in this rule CI criticality, Business criticality and Vulnerability Exploit attack vector weights are 0. I attached the risk rules for each field value:
From above VIT, if I calculate Risk score:
Risk score = (60(75)+30(100)+10(50))/100 = 80. But the risk score is showing on above VIT is 75.
What I missed in my calculation?
