Swif.ai’s Shadow IT Risk Score evaluates the security risk of each (employee, app) pair daily.
The scoring model combines multiple dimensions to give security teams a comprehensive risk view and prioritization strategy.
Total Risk Score Formula
For each employeeId + appId pair, the daily score is:
Total Risk Score =
Access Frequency Score + Privilege Level Score + Data Sensitivity Score + Anomaly Score + Compliance Score
1. Access Frequency Score
Purpose: Captures how often a user accesses the app.
Inputs:
List of access records for that user/app
App’s catalog tags + precomputed catalog weights
Logic:
If app catalog list is empty → multiplier = 3.0
If catalogs contain unknown tags → multiplier = 3.0
If all catalogs are recognized → multiplier = average of associated weights
Formula:
score = record_count × risk_multiplier
2. Privilege Level Score
Purpose: Measures risk based on user role in the app.
Role | Score |
Admin | 20 |
Standard | 10 |
Other/None | 0 |
3. Data Sensitivity Score
Purpose: Evaluates the sensitivity of the data in the app.
Sensitivity Level | Score |
HighlySensitive | 50 |
PII | 40 |
BusinessSensitive | 30 |
Internal | 20 |
Public | 10 |
Unknown | 25 |
4. Anomaly Score
Purpose: Flags unusual access patterns.
Factors:
Night Access (23:00–05:00 UTC) → +10
IP Address Change → +10
Location Change:
Cross-country → +30
Cross-city (same country) → +10
Tags Captured:
"Night Access","IP Changed","Cross-Country Access","Geo Distance > 500km","Cross-City Access"Raw Score → Normalized (1–60):
Raw Score Range Normalized Score ≤ 0 1 1–20 5–15 21–50 15–30 51–100 30–45 101–200 45–55
5. Compliance Score
Purpose: Considers the compliance posture of the app.
Compliance Tag | Score |
Non-compliant | 30 |
Partially Compliant | 15 |
Fully Compliant | 0 |
Risk Level Mapping
Total Score | Risk Level |
≤ 40 | Low |
41–60 | Medium |
61–100 | High |
> 100 | Critical |
Example Risk Score Breakdown
Below is an example visualization of how different dimensions can contribute to a total risk score.
This type of chart helps security teams quickly identify which factors are driving the highest risk for a given app.