Trust score risk levels

The Trust Score mechanism describes the level of trust of a single session. It is based on the correlation between the values and behavior that is seen in the current session and the user’s history. It also defines whether the session is risky in comparison to the general population.

The scores range 0 - 1000, where 1000 is the maximum risk. Those scores are divided into bins in order to apply the risk levels and set the policies.

  • Low: 0-199
  • Medium: 200-399
  • High: 400-699
  • Very High: 700-1000
Based on the Trusteer knowledge base, the following score distributions are typical:
  • Low: 70-90% of sessions
  • Medium: 5-15% of sessions
  • High: 2-8% of sessions
  • Very High: 0-5% of sessions

Scenario examples

Table 1. Score level examples
Score level Examples
  • Old and trusted device in an account.
  • First session in an account.
  • Old device from a new location.
  • Old device that accesses the account after dormancy.
  • Old device from a risky internet provider.
  • New device in an account.
  • Significant device attributes change - new screen, use of a new language.
  • New device with rare attributes.
Very High
  • New device from a risky internet provider.
  • New device from a new country.
  • New downgraded device.
  • New device with spoofing indications.
  • Old device with risk indications - active VM, active remote access tool.