Tachi Risk Scoring

tachi-risk-scoring

Quantitative risk scoring domain knowledge extracted from the tachi risk-scorer agent. This skill provides the reference tables, formulas, and assessment criteria that the risk-scorer uses to transform qualitative threat findings into data-backed risk scores.

Domain Overview

The risk scoring model assesses each threat finding on four dimensions:

1. CVSS 3.1 Base Score (weight: 0.35) -- Inherent vulnerability severity using standard CVSS 3.1 vector analysis, with AI-specific refinements for agentic and LLM threat categories
2. Exploitability (weight: 0.30) -- Practical attack feasibility across four sub-dimensions: known techniques, attack complexity, tooling availability, and skill level
3. Scalability (weight: 0.15) -- Blast radius and operational economics across four sub-dimensions: scriptability, target scope, resource requirements, and detection difficulty
4. Reachability (weight: 0.20) -- Architecture-aware attack surface exposure derived from trust zone position, zone name analysis, and architecture barrier adjustments

Dimensional scores combine into a weighted composite score (0.0-10.0), which maps to a severity band (Critical/High/Medium/Low) that drives governance fields (SLA, disposition, review date).

AIVSS Relationship

Tachi's four-dimensional composite scoring model diverges from OWASP AIVSS at the present time. AIVSS v0.8 (the latest published version, with its public review period opening 2026-04-16) builds on CVSS v4.0 and uses an amplification model in which 10 Agentic AI Risk Factors uplift the CVSS baseline up to a 10.0 ceiling, then a mitigation factor scales the result. Tachi uses CVSS 3.1 and a weighted-sum composite across four operational dimensions (CVSS, Exploitability, Reachability, Scalability). The two formulas produce measurably different scores on the same finding — see ADR-024 for the three-surface comparison (dimensions, formula, severity bands), the worked examples that quantify the divergence, and the re-evaluation trigger tied to AIVSS reaching stable v1.0 with at least one external adopter case study. Severity bands are aligned (Surface C overlap), so downstream consumers (governance, SLA, color coding) behave identically across the two frameworks' outputs.

Baseline-Aware Scoring Rules

Score Inheritance

When a finding has delta_status: UNCHANGED, all scoring fields are inherited verbatim from the baseline run:

When to inherit: Only when delta_status is UNCHANGED. The finding's component, threat, likelihood, and impact must all match the baseline exactly.

When NOT to inherit: UPDATED findings are re-scored fresh using the full 4-dimensional model. NEW findings are scored fresh. RESOLVED findings retain last-known scores but are not actively scored.

Score Source Field

Every scored finding includes score_source (per schemas/risk-scoring.yaml v1.1):

• "inherited" — Scores copied from baseline (UNCHANGED, RESOLVED)
• "fresh" — Scores computed this run (NEW, UPDATED)

Bounded Scoring for NEW Findings

When scoring NEW findings from Phase 2 isolated discovery, the CVSS base score is constrained within ±1.0 of the category default. This prevents score drift from LLM non-determinism while still allowing meaningful differentiation between findings in the same category.

Formula: clamped_score = clamp(assessed_score, category_default - 1.0, category_default + 1.0), where clamp(v, min, max) returns min if v < min, max if v > max, and v otherwise. The outer bounds are always [0.0, 10.0].

Applicability:

Edge cases at CVSS extremes:

• Category default 9.5 → bounded range 8.5–10.0 (CVSS ceiling caps upper bound)
• Category default 1.0 → bounded range 0.0–2.0 (CVSS floor caps lower bound)
• Category default 0.5 → bounded range 0.0–1.5 (floor applies)

When no baseline is present: Bounding does not apply. All findings are scored without constraints using the standard 4-dimensional model.

First Run Behavior

When no baseline is present, all findings receive score_source: "fresh" and are scored using the standard 4-dimensional model. No behavioral change from pre-baseline pipeline.

Governance Field Persistence

When scoring findings with delta_status from a baseline-aware run, governance fields follow carry-forward rules to preserve human-assigned values across pipeline runs.

Core principle: risk_owner is a human-assigned field and is never auto-overwritten by the scoring pipeline. SLA and disposition are only recalculated when the severity band changes.

Carry-forward by delta status:

SLA recalculation trigger: Compare the baseline severity band to the current severity band. If different, recalculate remediation_sla and review_date using the new band's mappings. The risk_disposition threshold is: Critical/High → "Mitigate", Medium/Low → "Review".

Baseline governance detection: Parse the baseline risk-scores.md governance fields by matching on finding ID. If baseline risk-scores.md is unavailable, assign fresh governance fields for all findings (graceful degradation).

Loading Table

Reference files are loaded on-demand by the risk-scorer agent at specific workflow phases using the Read tool (per ADR-002).