Two Qualys VMDR assets carry the same critical QIDs, yet one has a TruRisk Score of 900 and the other 350 — what explains the gap?

## What TruRisk Score is Qualys VMDR attaches a **TruRisk Score** to each asset, so you can prioritise by the risk to that asset rather than by technical severity alone. The help page "Calculating TruRisk Score" notes the score was formerly called Asset Risk Score. It runs from 0 to 1000 in four bands: | Band | Range | |---|---| | Severe | 850-1000 | | High | 700-849 | | Medium | 500-699 | | Low | 0-499 | It is built from three inputs: 1. **Asset Criticality Score (ACS)**: 1 to 5, set by you through asset tags. 2. **Qualys Detection Score (QDS)**: 1 to 100 for each QID detected on the asset. 3. **A weighting factor (w)**: assigned automatically for each severity level of QID (critical, high, medium, low). ## The formula for a managed asset For a managed asset, Qualys's help gives: ``` TruRisk = MIN( ACS * ( wc*Avg(QDSc)*Count(QDSc)^(1/100) + wh*Avg(QDSh)*Count(QDSh)^(1/100) + wm*Avg(QDSm)*Count(QDSm)^(1/100) + wl*Avg(QDSl)*Count(QDSl)^(1/100) ), 1000) ``` Three things follow: - **ACS is a straight multiplier.** Two assets with identical findings and identical QDS values differ by the ratio of their ACS, unless the cap or the external multiplier intervenes: 5 against 2 is 2.5 times. - **The count barely matters.** A count raised to the power 1/100 grows very slowly: 100 findings give about 1.05, and 1,000 give about 1.07. More vulnerabilities still raise the score, but the average QDS per severity drives it. - **The cap is 1000.** Past it, more findings change nothing. An asset marked external has its whole TruRisk Score multiplied by 1.2, and the score details list its External Tags. Externally exposed unmanaged assets use a separate formula built on QVS and an asset-exposure factor. ## Where the gap usually comes from A ratio near 900:350 is close to 5:2, so start with criticality. - **ACS from tags.** ACS is defined on tags. If an asset has several, the highest ACS wins: six tags valued 1 to 5 contribute their maximum. The onboarding guide warns that **newly discovered assets get a default ACS of 2** until you assign one. A crown-jewel server never tagged sits at 2, and its score understates the risk. - **QDS per detection.** QDS comes from the highest **Qualys Vulnerability Score (QVS)** among the QID's CVEs, from threat intelligence (exploit code maturity, malware, active threat actors, trending), and from mitigation controls. The help states `QDS = QVS - CID`: mitigation controls (CIDs) applied through Qualys compliance modules lower the score. With no CID applied, QDS equals QVS. The same QID can therefore score lower on a host where a mitigating control is in place. - **Exposure.** An external tag multiplies the result by 1.2. - **Timing.** Asset changes update QDS and the TruRisk calculation **after an asset scan**. If you raised one asset's ACS this morning, the two scores may simply not have been recalculated yet. ## A worked example Suppose the bracketed sum (the weighted QDS averages with their count terms) comes to 180 on both assets, because they carry the same QIDs with the same QDS values. Then: - The asset tagged with ACS 5 scores 5 x 180 = 900, which is Severe. - The untagged asset, still on the default ACS 2, scores 2 x 180 = 360, which is Low. That matches the gap in the question almost exactly. The likely fix is a missing criticality tag, not a scoring fault. ## How to read it in the console 1. Open the asset from the Vulnerabilities tab (Asset view). The TruRisk Score Details page lists the contributing factors: Business Criticality (the ACS), Asset Exposure (shown only when an external tag exists) and Risk Factors. 2. Open the Risk Calculation to see the formula with the asset's own numbers. 3. Sort the asset's vulnerabilities by QDS, the default sort, and open the top QID's QDS Details. It shows the highest-contributing CVE, associated malware and threat actors, and exploitability. 4. In the Prioritization report, TruRisk mode filters by ACS range (1 to 5), by QDS band and by TruRisk band. ## Judgement The score is only as good as your tagging. Assign ACS to the most valuable assets first, use dynamic tags so new assets are classified on discovery, and review anything still at the default 2. When two scores disagree, explain the inputs before you question the vendor's maths.