How to use this calculator
- Enter or choose factor 1.
- Enter or choose factor 1 score.
- Enter or choose factor 1 weight.
- Enter or choose factor 2.
- Enter or choose factor 2 score.
- The weighted risk index updates as you type. Use Copy result or Share to keep it.
Method
Index = 10 × Σ(Weightᵢ × Scoreᵢ) ÷ Σ Weightᵢ; Points from factor i = 10 × Weightᵢ × Scoreᵢ ÷ Σ Weight
- Scoreᵢ
- your 0–10 rating of factor i (10 = worst)
- Weightᵢ
- how much factor i counts relative to the others (any positive numbers)
Worked example
- Weighted sum = 3×7 + 3×6 + 2×8 + 2×4 = 21 + 18 + 16 + 8 = 63.
- Total weight = 3 + 3 + 2 + 2 = 10.
- Index = 10 × 63 ÷ 10 = 63 out of 100; internet exposure contributes 21 points, the most.
With these four factors the weighted risk index is 63 out of 100, driven mostly by internet exposure.
What the result means
Use the index to compare systems or track one system over time with the same factors and weights. The number has no meaning outside your own scoring scheme, so do not compare it with scores built on different factors, and do not treat it as a probability of a breach.
Assumptions and limits
- Factors are scored on the same 0–10 scale, where higher means riskier.
- Weights are relative; only their proportions matter.
- A weighted average cannot capture interactions, such as a critical vulnerability on an internet-facing system being far worse than either alone.
- For likelihood-and-impact assessments, follow your organisation’s method (for example NIST SP 800-30 or ISO/IEC 27005).
Questions
Is this an industry-standard risk score?
No. It is a transparent weighted average of the factors you choose. Standards such as NIST SP 800-30 describe how to assess likelihood and impact; this tool only does the arithmetic of combining your ratings.
How should I choose the weights?
Agree them with stakeholders before scoring, write them down and keep them fixed, so that changes in the index reflect changes in risk rather than in the method.