Understand a Risk Score

By the end of this guide you will know what a Risk Score means and what to do about a finding at each level.

Before you start

You need a nebty account with at least one brand set up, and a finding to look at, for example a domain in Domain Monitoring. If you do not have one yet, you can follow the same steps in the public demo.

Steps

1. Open a finding, for example a domain from your Domain Monitoring table.
2. Look at the Risk Score. It rates the finding from 1 to 10, where higher means more dangerous.
3. Read the band the score falls into:
   • High (8 to 10): treat as urgent.
   • Medium (4 to 7): worth a closer look.
   • Low (1 to 3): likely harmless, but on the record.
4. Check the AI Verdict next to the score. It is one of Suspicious, Benign, or Unknown, and tells you whether the finding looks like your brand.
5. Read the two signals together. A High Risk Score paired with a Suspicious verdict is the clearest signal that you should act. A High score with an Unknown verdict still deserves a closer look, since nebty could not confirm either way. A Low score with a Benign verdict is usually safe to leave as is.
6. Decide what to do based on the band:
   • High: review the finding now and, if it is genuine impersonation, select Request Takedown on the domain’s detail page.
   • Medium: review it when you get to your queue. Mark it This is us if the domain is legitimately yours, otherwise request a takedown once you have made a call.
   • Low: no action needed. It stays on record in case its score changes later.

What happens next

Risk Scores can change as nebty gathers more information about a finding, so a Medium score today is not necessarily a Medium score next week. Reviewing High scores first keeps your attention on what matters most.

Try this on a live example in the demo.

▶Open Domain Monitoring in the demo(opens the public demo with sample data)

Related: Domain Monitoring.