What a Single Confirmed-Malicious Threat Intel Hit Should Do to Your Risk Score
A common design pattern in risk scoring is purely additive: every signal contributes some number of points, capped, and the points add up to a final score. It's simple to reason about and easy to tune — until a single very strong signal shows up, and the additive model quietly under-reacts to it. Here's a concrete version of the problem we ran into: an IP address confirmed by ThreatFox as active…
Conventional risk scoring models typically add up points from various signals, with a cap, to arrive at a final score. This method is straightforward to understand and adjust but can underreact to single strong signals. Our recent experience with a confirmed Cobalt Strike command-and-control IP address demonstrated this flaw. The IP address, confirmed by ThreatFox with 100% confidence, was linked to an API endpoint.
Under an additive model, the ThreatFox match added a capped +30 points. Combined with a low-risk user-agent signal, the event scored 33 out of 100, classified as low severity and deemed safe from deeper automated review. This outcome was incorrect. A single, strong confirmation, such as a confirmed malware IP address, should have a more significant impact than multiple weaker signals.
It should dominate the score, given the disparity in evidential weight. The IP address, while unusual, is far more concrete and reliable than a user-agent that is merely atypical. The solution was to implement a floor rule, rather than simply increasing the additive weight. Any single source independently confirming malicious activity, like a ThreatFox IOC match, OTX malicious flag, a GreyNoise malicious classification, AbuseIPDB confidence above 75%, or a sandbox verdict, should floor the event's score at 75, irrespective of the additive components' contribution.
This same Cobalt Strike event, which previously scored 33, now scores 75, surpassing the threshold for full AI-assisted analysis. The model emphasizes that additive scoring can be a viable default for integrating many weak-to-moderate signals. However, it is prone to undervaluing rare, high-confidence, independent confirmations.
If your scoring system has a signal that indicates "we are certain," it must come with a floor, not just a point value.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
