How is the Mobile Software Risk Vector Assessed? – Bitsight Knowledge Base

⇤ How is the Diligence Risk Category Calculated?

The Mobile Software risk vector assesses the supported or unsupported status of the software version. The usage of mobile software is not required to improve an organization's cyber security posture.

Grading of this risk vector is based on the estimated number of users. Each finding in this risk vector can be associated with one or more estimated users.

Concept

Behavior

Insufficient Data

A default risk vector grade is assigned.

Default: ∅ – N/A

This default grade does not have a negative impact on the rating. It is equivalent to a perfect grade.

Either:

There are no findings.
The estimated number of users falls below a minimum threshold. To avoid sudden fluctuations, the risk vector is reassigned an A to F grade when the estimated number of users has stayed above the threshold for 65 days.

Lifetime

The number of days a finding impacts the risk vector grade, assuming nothing changes in the future and the finding is not updated with new information. Learn why findings have a decay and lifetime period.

Duration: 65 Days

There’s a grace period of 28 days for validating and updating software packages. See finding behavior.

Weight

Percentage (out of 70.5% in Diligence): 1%

Finding Grading

The operating system (OS) and browser are graded independently from one another based on their support status. The finding grade is calculated from a combination of the OS and browser grades.

There is a grace period of 28 days to allow for validating and updating software packages.

During the grace period, findings have a FAIR grade.
FAIR findings for this risk vector do not have an impact on the rating.
Findings observed after the end of the grace period and less than 365 days after the end of support have a WARN grade.

See the following resources for more information:

March 25, 2024: “No findings/low findings” changed to “insufficient data.”
January 4, 2024: Clarified conditions for N/A risk vector grade.
December 4, 2023: Finding lifetime definition link changed to Finding Lifetime section.

Finding Grading

Related articles