> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Understand how the Plerion Risk Score (PRS) quantifies risks across assets, findings, and vulnerabilities in your cloud environment.

## Background

To assess the security posture of your cloud environments, Plerion applies a scoring system that evaluates each asset and its associated findings. The result is a **Plerion Risk Score (PRS)**: a numerical value that reflects the severity of risks, helping teams prioritize remediation.

PRS is calculated by Plerion’s risk engine, which combines **likelihood**, **impact**, **asset context**, and **modifiers**. Unlike CVE or CVSS scores, which assume worst-case scenarios, PRS incorporates asset-specific context for higher fidelity.

***

## Key terms

* **Risk**: A potential adverse event, derived from both its likelihood of occurring and the impact if it does.

* **Risk description**: A detailed explanation of a potential risk.\
  Example: *A system compromise due to exploitation of Amazon EC2 instance with remote code execution vulnerability*

* **Finding**: A technical description of an asset condition discovered during evaluation.\
  Example: *Publicly accessible Amazon S3 bucket*

* **Check**: A condition tested against an asset to identify potential risks.\
  Example: *Identify publicly accessible Amazon S3 buckets*

* **Control**: A condition assets must meet to mitigate risks.\
  Example: *Ensure Amazon S3 buckets are not publicly accessible*

* **Likelihood**: The probability of a risk being realized, score from 1 (rare) to 5 (almost certain).\
  Example: *Likelihood of a publicly accessible Amazon S3 bucket = 4*

* **Impact**: The consequence of a realized risk, scored from 1 (insignificant) to 5 (severe).\
  Example: *Impact of a publicly accessible RDS server = 4*

* **Risk score**: A calculated value (0–10, up to two decimal places) representing overall asset risk. For workloads, vulnerabilities are also included.

<Note>
  PRS adjusts baseline impact and likelihood values with asset-specific modifiers, making it different from CVSS or CVE scores.
</Note>

* **Risk rating**:  A severity category based on likelihood and impact: **None, Low, Medium, High, Critical**.

<Frame>
  <img src="https://mintcdn.com/pleriondocs/kZep2o9T0iPastk9/images/product/plerion-risk-score/risk-severity.png?fit=max&auto=format&n=kZep2o9T0iPastk9&q=85&s=ac843473cb238aa13cde47f3a16a66b2" alt="Risk Rating by Impact and Likelihood" width="1199" height="594" data-path="images/product/plerion-risk-score/risk-severity.png" />
</Frame>

* **Modifier attributes**: Asset context that adjusts impact, likelihood, or both.\
  Example: *`is publicly exposed`, `has overly permissive privileges`*

* **Modifier value**: The numeric adjustment applied to baseline likelihood or impact when modifiers are present.\
  Example: *If `has overly permissive privileges` has +2 to likelihood, an asset with this attribute will calculate at a higher severity level*

***

## Further reading

* [Asset risk score](/guides/platform/plerion-risk-score/asset-risk-score)
* [Integration and tenant risk score](/guides/platform/plerion-risk-score/integration-and-tenant-risk-score)
* [Managing your risk score](/guides/platform/plerion-risk-score/managing-risk-scores)