Risk: Turning evidence into priority
On this page
Investigate stage · phase 5 of 7
How bad is it, and how confident are we?
Risk turns Uncover’s evidence into a defensible priority. The phase scores impact (how bad, if real) and likelihood (how probable it is that the activity is malicious), records confidence beside them, then reads the priority and a recommended move off the triage matrix.
What Risk is for
Uncover answered “what happened.” Risk answers “how much does it matter, and how confident are we.” Together they give the Escalation decision a scored recommendation to act on, set the resource allocation, and leave the documented justification that survives the case.
What you will get from this chapter
The three pillars
Impact and likelihood
The two axes every Risk assessment is built from: how to evaluate each separately, and how the combination produces the priority.
ReadThe priority matrix
The Risk-Based Alert Triage Matrix and the triage matrix it feeds: four scored dimensions, the cell-to-band mapping, the override rules and the default clocks, with vulnerability signals as input when a CVE is in play.
ReadWhat a benign close teaches
Closed cases are not wasted cases. Each benign close, false positive or benign true positive, sharpens the detection logic and the analyst's instinct.
ReadThe dynamic loop: Scope → Uncover → Risk
Triage is not strictly linear. The investigative engine of ASSURED is an iterative loop through Scope, Uncover, and Risk that runs until clarity is reached. Risk findings often send the analyst back to Uncover for more evidence; new evidence sometimes forces a fresh Scope decision; that fresh Scope reframes what Uncover and Risk look at next. Embracing the loop is part of the methodology.
Initial Scope
Define investigation boundaries from the alert context. Deliberately narrow at the outset to keep noise down.
Uncover evidence
Gather and analyze data from targeted sources. Bounded by the current scope to avoid sprawl.
Assess risk
Evaluate impact and likelihood based on what was found. The triage matrix sets the priority (P1-P4) and its clock, and Risk recommends one of three moves: close, escalate, or rescope and run the loop again. The Escalation decision records the call.
Refine scope
Adjust boundaries based on new understanding. Reactivates the loop with updated parameters.
Triggers that send you back through the loop
The loop iterates when something surfaces the original scope did not anticipate: signs of lateral movement into unscoped systems, use of alternate user identities or service accounts, possible data staging or exfiltration, or discovery of a high-value or compliance-sensitive asset that was not in the original entity map. Each pass increases investigative fidelity. For unresolved cases the loop terminates when the residual risk is sufficiently understood to justify a resolution: close or escalate.
One exception outranks the loop: a confirmed escalation criterion trips the escalation tripwire, and the case escalates from wherever the loop stands (see the override rules).
Risk at a glance
- Question
-
How bad is it, and how confident are we?
- Deliverable
- The Risk verdict block: impact, likelihood and confidence each with a rationale, the matrix cell and priority (P1 to P4), any override that fired, open questions, and a recommended move. When the case escalates, it travels as section 5 of the handoff packet.
- Done when
- Every axis scored, with nothing Unknown scored as Low; the cell read and the override named (or “none”); the recommended move written, with its clock; and, for a P3 or an undetermined verdict, a named re-score trigger with a time.
| Level | At this level, Risk is |
|---|---|
| Level 0 pattern close | No RATM scoring. The pattern entry stands in for the assessment, and the five-field record’s verdict line carries it. A failed discriminator or gate check moves the case up; a malicious verdict trips the escalation tripwire. |
| Level 1 standard triage | A few lines: impact, likelihood and confidence, the cell and band, and the recommended move, written into the alert report. |
| Level 2 full arc | The full four-dimension RATM record, the override rules applied in order, and the Scope → Uncover → Risk loop running until the residual risk is understood, on the clock the band sets. |
Why Risk is its own phase
- Evidence and impact are separate questions. Uncover answers what happened. Risk answers how much it matters. Skipping Risk means escalating every finding equally, which is the same as not prioritizing at all.
- Likelihood and confidence are separate lines. Likelihood estimates how probable it is that the activity is malicious; confidence says how well the evidence supports that estimate. A high-impact finding resting on thin evidence is a different decision from the same finding with airtight evidence, so the analyst states both.
- Context changes the priority. The same intrusion on a sandbox is not the same intrusion on a regulated production system. Risk is the phase that brings that context into the priority.
- Benign closes have value. A benign close sharpens detection, whether the rule misfired or fired correctly on authorized activity. The methodology asks the analyst to capture what they learned, even when the verdict is “no incident.”
Key takeaway
Risk turns evidence into priority and records confidence beside it. Its output is a scored recommendation the Escalation decision acts on, with reasoning the rest of the team can defend.Technical details verified . Product names, defaults and retention change; check your own tenant.