Case Risk Score

The case risk score is a numerical rating that reflects both the likelihood of the activity being malicious and the potential impact it may have on your environment.

Cases with at least one detection are assigned a risk score, while those without any detections are not assigned a risk score.

Note

Cases created prior to the deployment of this feature do not have a risk score assigned. Depending on your tenant's region, this was between October 2025 and March 2026.

For users opted in to Preview mode, the risk score shows in the table on the Cases page and next to the case name on case details pages.

Risk Score in Cases Table

Tip

Use the Risk Score filter on the left of the table to show only cases with a certain score.

Risk Score in Case Details

Risk Score Calculation

Currently, the case risk score equals the highest threat score of all detections added to the case. Later, the risk score will incorporate multiple risk factors for more accurate and nuanced scoring.

Risk Score Update

The case risk score is recalculated automatically when the following occurs:

• New detections are added to an open case.
• Existing detections are removed from an open case.

Closed cases do not receive score updates, even if detections are modified.