Campaigns and asset risk
Use actor context and risk-ranked assets to prioritize investigation and remediation.
Campaign context connects related indicators, techniques, and targeted industries. Asset risk combines that context with observed exposure and findings so teams can prioritize work.
Open Intelligence → Campaigns and filter by industry, activity period, and technique. A campaign page separates reported activity from observed matches in your organization. Attribution can change as intelligence develops; record the campaign version in exported reports instead of treating an actor name as a permanent identity.
Read asset risk
At Assets → Asset → Risk, inspect the current band, assessment time, contributing findings, public exposure, intelligence matches, and missing observations. Risk uses low, medium, high, or critical; unknown means there is insufficient current coverage. A critical vulnerability on an isolated test device and the same vulnerability on an exposed payment service can have different remediation priority.
The view shows contributing factors rather than a promised probability of compromise. Findings keep their technical severity separately. An analyst cannot erase an exploitable finding by lowering the asset's business importance or closing its incident.
Change priority and verify
An asset owner updates business criticality at Assets → Asset → Ownership and criticality with a reason. Security staff review the resulting risk context, validate external exposure, and assign a remediation task. If a risk contribution is incorrect, correct its underlying observation or record an expiring exception; do not overwrite the source finding.
After remediation, run the relevant verification scan and inspect the recalculation time. A lower risk band does not certify the absence of other vulnerabilities. Delayed feeds, offline agents, failed authentication, and stale inventory are coverage limitations shown alongside the result.
Use Reports → Create report → Risk posture for a fixed reporting period. Include assets with unknown coverage and accepted risks in the report so improvements are not produced by silently excluding difficult targets.