Quick Answer: VeilScan's Business Impact Score (BIS) is a 0–10 risk rating calculated for each vulnerability finding and for each scan overall. It translates technical severity (similar to CVSS) into a business risk assessment by weighting asset criticality, data exposure risk, compliance impact, and attack path context. A BIS above 7.0 indicates a finding with meaningful business harm potential.
What factors determine the Business Impact Score?
- Technical severity — the underlying vulnerability's inherent severity (equivalent to CVSS base score)
- Asset criticality — customer-facing production services score higher; test subdomains score lower
- Data exposure risk — whether exploitation could expose PII, payment data, credentials, or secrets
- Compliance impact — whether the finding affects specific ISO 27001, SOC 2, GDPR, or PCI DSS controls
- Attack chain context — findings in attack paths are scored upward to reflect the combined chain risk
What do Business Impact Score ranges indicate?
- 8.0–10.0 — Immediate action required: confirmed risk of serious business harm
- 6.0–7.9 — Fix in current sprint: meaningful risk to address in the near term
- 4.0–5.9 — Schedule for remediation: some risk, addressable in routine maintenance
- 0–3.9 — Monitor: informational findings with minimal business impact
How is BIS used for board reporting?
The scan-level BIS — the overall score for your domain — is designed for board and executive communication. It appears prominently in the executive summary of each PDF report. Delta reports show BIS trends across scans, demonstrating measurable security improvement over time.
See: Business Impact Score feature · CVSS Score · What Is Business Impact Scoring?
What are common questions about Business Impact Score?
What does Business Impact Score mean in cybersecurity?
Business Impact Score describes a security concept that affects how teams understand, monitor, and reduce external exposure across internet-facing assets.
Why does Business Impact Score matter for external attack surface monitoring?
It matters because attackers continuously inspect public assets. Tracking this concept helps teams reduce exploitable exposure before it becomes a breach path.
How does VeilScan help with Business Impact Score?
VeilScan discovers public assets, validates findings with proof, prioritises issues by business impact, and explains remediation in reports built for engineering and leadership.
What related terms should you read next?