Risk Score (RS)

The Risk Score (RS) provides a comprehensive risk assessment for each component in your SBOM, helping you identify and prioritize supply chain security concerns.

Overview

RS evaluates components based on multiple risk factors to generate an overall integrity score. Unlike vulnerability scores which focus on known CVEs, RS assesses the trustworthiness and supply chain integrity of each component.

RS Score Range

Risk Factors

Supply Chain Attestation (SCAL)

The SCAL (Safeguard Component Attestation Level) is a key factor in RS calculation:

Provenance Verification

Package Health

Behavioral Analysis

Viewing RS

In Explore SBOM

1. Open a project from the Projects page
2. Navigate to Explore SBOM
3. Click the RS tab
4. View RS scores for all components

RS Dashboard

The RS tab displays:

Filtering and Sorting

• Filter by Risk Level - Show only High/Critical components
• Filter by SCAL - Show components above a certain attestation level
• Sort by RS - Highest risk first
• Search - Find specific components

RS Details

Click on any component to view detailed RS breakdown:

Risk Breakdown

Evidence

View specific evidence for each risk factor:

• Attestation documents found/missing
• Signature verification results
• Provenance chain details
• Behavioral analysis findings

Improving RS Scores

Quick Improvements

1. Update to attested versions - Use versions with SCAL 0-1
2. Replace unknown components - Swap SCAL 5 for verified alternatives
3. Remove unused dependencies - Reduce attack surface
4. Pin specific versions - Avoid version ranges

Long-term Strategy

1. Prefer Gold Directory packages - Pre-verified components
2. Establish component policies - Require maximum SCAL levels
3. Monitor RS trends - Track improvements over time
4. Vendor engagement - Request attestations from suppliers

RS Policies

Setting RS Thresholds

Create policies based on RS:

1. Go to Policies & Gates
2. Create new policy rule
3. Set RS threshold (e.g., fail if any component > 6)
4. Apply to projects

Policy Examples

API Access

# Get RS scores for a project
curl -X GET https://api.safeguard.sh/v1/projects/{id}/rs \
  -H "Authorization: Bearer $API_KEY"

# Get RS details for a component
curl -X GET https://api.safeguard.sh/v1/projects/{id}/components/{component}/rs \
  -H "Authorization: Bearer $API_KEY"

Best Practices

Monitoring

• Review high RS components weekly
• Set up alerts for RS increases
• Track RS trends in dashboards

Remediation

• Prioritize SCAL 5 components first
• Create tickets for high RS components
• Document accepted risks with mitigations

Prevention

• Include RS checks in CI/CD
• Block high RS components in security gates
• Train developers on component selection

Next Steps

• Attestation
• Security Posture
• Policies & Gates