DriftRisk™

DriftRisk™ is a single 0–100 headline for executives: how much pressure is this codebase putting on the team to act? It is a pure, derived function of the two published axes — DriftScore (maintainability) and RiskScore (security exposure) — and never feeds back into either.

How It Works

Risk's weight in the blend grows with the RiskScore band (from 0.40 at low to 0.80 at critical), and band floors preserve the exploitation override at the blended level: an actively exploited vulnerability floors DriftRisk at 80 even on an otherwise current stack, so a live security emergency never reads green because upgrade debt is low. The blend is monotonic — getting worse on either axis can never lower the headline — which makes it a legitimate sort key across a portfolio.

Bands: 0–30 low, 31–60 moderate, 61–100 high. The convention is to rank by the scalar but read the pair: Drift 40 · Risk 60 · DriftRisk 67.

DriftRisk is a trademark of Vibgrate; the algorithm itself is open source and specified in full in the public scoring specification.

Why It Matters

Executives want one number; practitioners need two. DriftRisk gives leadership a single, portfolio-comparable figure while always showing the two constituent axes beside it, so the detail is never hidden behind the blend.

Related Terms

DriftRisk is derived from DriftScore and RiskScore, whose critical band is driven by exploitation evidence from KEV and likelihood from EPSS.