# Understand a Risk Score

> What the Risk Score on a nebty finding means and what to do at each level.

By the end of this guide you will know what a Risk Score means and what to do about a finding at each level. The red numbers in the screenshots match the numbers in each step.

## Before you start

You need a nebty account with at least one brand set up, and a finding to look at, for example a domain in Domain Monitoring. If you do not have one yet, you can follow the same steps in the public demo.

## Steps

1. **Open a finding.** In the **Domains** tab (1) of your brand, select a domain from the table (2). The table is sorted by risk score, highest first.

   ![Domains list of the brand Solara Finance with the Domains menu entry marked 1 and the domain solara-finance-secure-login.com marked 2](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/1-open-a-finding.webp)

2. **Look at the Risk Score** (1). It rates the finding from **0 to 10**, where higher means a greater potential threat to your brand. 0 means no risk, for example because you marked the domain as yours. [How the Risk Score works](https://docs.nebty-id.com/features/risk-score/) explains what goes into it. The same number appears in the **Risk** column of the Domains table.

   ![Domain detail page with the Risk Score 10 marked as 1](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/2-risk-score.webp)

3. **Read the band the score falls into.** The **Risk Distribution** (1) on the brand overview groups your domains by the same bands, and the risk filter in the Domains tab offers them too:

   - **High (8 to 10):** treat as urgent.
   - **Medium (4 to 7):** worth a closer look.
   - **Low (1 to 3):** likely harmless, but on the record.

   ![Brand overview with the Risk Distribution card marked as 1, showing the counts for Low Risk (1-3), Medium Risk (4-7) and High Risk (8-10)](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/3-risk-bands.webp)

4. **Check the AI Verdict** (1) next to the score. It is one of **Suspicious**, **Benign**, or **Needs Review**, and tells you whether the site copies your brand’s look, sells your products under your name, or both. **Why the model flagged this** (2) gives the reasons in a sentence or two. In the scan history and in the verdict filter, a finding that has not been assessed yet is called **Not Yet Assessed**.

   ![Domain detail page with the AI Verdict Suspicious marked 1 and the box Why the model flagged this marked 2](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/4-ai-verdict.webp)

5. **Read the two signals together.** A High Risk Score paired with a Suspicious verdict is the clearest signal that you should act. A score with a **Needs Review** verdict still deserves a closer look, since nebty could not confirm either way. In the example, the verdict (1) is Needs Review while the score (2) is 7, and the explanation (3) says that the check could not confirm or rule out impersonation and that no person has confirmed the finding yet. A Low score with a Benign verdict is usually safe to leave as is.

   ![Domain detail page of a finding with the verdict Needs Review marked 1, the Risk Score 7 marked 2 and the box Why the model flagged this marked 3](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/5-read-together.webp)

6. **Decide what to do based on the band.** The two buttons on the detail page are **This is us** (1) and **Request Takedown** (2):

   - **High:** review the finding now and, if it is genuine impersonation, select **Request Takedown** on the domain’s detail page.
   - **Medium:** review it when you get to your queue. Select **This is us** if the domain is legitimately yours, otherwise request a takedown once you have made a call.
   - **Low:** no action needed. It stays on record in case its score changes later.

   ![Domain detail page with the This is us button marked 1 and the Request Takedown button marked 2](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/6-decide.webp)

## What happens next

Risk Scores can change as nebty gathers more information about a finding, so a Medium score today is not necessarily a Medium score next week. The **Scan history** (1) of a domain lists its past scans with the risk and the AI verdict of each one, so you can see how a score moved. Reviewing High scores first keeps your attention on what matters most.

![Scan history of a domain with four scans marked as 1, where the risk rises from 7 to 10](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/7-scan-history.webp)

Try this on a live example in the demo.

[Open Domain Monitoring in the demo (opens the public demo with sample data)](https://dash.nebty.de/demo/brands/demo-brand-1?tab=domains)

Related: [Domain Monitoring](https://docs.nebty-id.com/features/domain-monitoring/).