Introducing DriftRisk™: one number for how hard to act

Meet DriftRisk™

Today we're introducing DriftRisk™ — a single 0–100 headline that answers the one question every engineering leader asks about a codebase: how hard should we act, and how soon?

DriftRisk isn't a new measurement. It's a derived headline that blends the two scores Vibgrate already publishes — DriftScore (how far behind you are) and RiskScore (how exposed you are) — into one number you can put on a dashboard, a badge, or a board slide. It's always shown next to the two scores it comes from, so the headline never hides the detail.

Why a third number

DriftScore and RiskScore live on different axes on purpose. But a leader triaging twenty services doesn't want to mentally combine two numbers twenty times. DriftRisk does that combination in a consistent, published way:

The one rule that makes it trustworthy

The second row is the whole point. A stack can be perfectly current and still be on fire because one dependency has an actively-exploited vulnerability. A naive blend would average that emergency down into a calm "moderate" because the drift is low. DriftRisk applies an override: when RiskScore is critical (a CISA Known-Exploited vulnerability), DriftRisk is high regardless of how current the stack is. A live security emergency never reads green because upgrade debt happens to be low.

Open algorithm, protected name

DriftRisk™ is a trademark of Vibgrate — but the algorithm is open source and published in full, including the exact blend and the override. The protection is on the name, not the method. DriftScore and RiskScore are not trademarked. You can read the complete, versioned methodology in our public scoring specification.

A badge for your README

DriftRisk ships as an embeddable badge alongside the DriftScore, RiskScore, and CVE badges. Whenever either your DriftScore or your RiskScore changes — on any scan — the DriftRisk badge refreshes automatically:

![DriftRisk](https://badges.vibgrate.com/driftrisk?repo=github.com/your-org/your-repo)

Try it

Scan your own project in about a minute — no account, no source uploaded:

npx @vibgrate/cli scan

Post-install, a bare vg scans the current directory. Push to Vibgrate Cloud to see DriftScore, RiskScore, and DriftRisk trend across every repository.