> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kikimora.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk management overview

> How Kikimora scores findings in the context of your environment, what portfolio impact points measure, and how the module connects to the rest of the platform.

**Risk management** is a read-only analysis module that aggregates, evaluates, and prioritizes security findings — CVEs and vulnerabilities — across your infrastructure.

Traditional scanners rank findings by static severity alone. Kikimora evaluates each vulnerability inside your organization's operational context and ranks it by actual **portfolio impact**, so the finding at the top of the list is the one that matters most to you rather than the one with the highest generic score.

## Kikimora Score

The **Kikimora Score** is a contextualized risk rating from **0 to 100**. It combines technical vulnerability severity with environmental factors: asset exposure, connectivity, policy enforcement, and criticality.

Scores are color-coded by band:

| Band         | Range    | Color           | What it means                                                             |
| :----------- | :------- | :-------------- | :------------------------------------------------------------------------ |
| Critical     | 80–100   | Red             | High impact and wide exposure. Remediate immediately.                     |
| High         | 60–79    | Orange / Yellow | Serious findings carrying elevated organizational risk.                   |
| Medium / Low | Below 60 | Green / Blue    | Lower-priority or isolated issues. Schedule during standard patch cycles. |

## Portfolio impact and points

Every finding carries a **Portfolio Score** in points — `157 pts`, `148 pts`, and so on. Points express the cumulative risk burden that finding imposes across every affected asset instance, which is why a moderate vulnerability on many hosts can outrank a severe one on a single host.

Three portfolio metrics summarize the picture:

* **Total portfolio risk points** — aggregated risk across all active endpoints, for example `66,086 pts`.
* **Portfolio impacted (%)** — the share of organizational risk attributable to the findings you have selected.
* **Risk reduction (%)** — the projected drop in overall portfolio risk if you remediate those findings.

## Related modules

* [Dashboard](/dashboard/index) — receives aggregated risk statistics and populates the *Most Critical CVEs* widget.
* [Vulnerabilities](/vulnerabilities/index) — the source of truth for raw detections and technical detail, before context-aware aggregation.
* [Endpoints](/endpoints/index) — connects findings to individual assets, host configurations, and policy checks.