Application risk scores help you quickly identify risky GenAI apps, so you can take
action to protect your environment.
Where Can I Use This?
What Do I Need?
NGFW (Managed by Strata Cloud Manager)
Prisma Access (Managed by Strata Cloud Manager)
One of the following:
AI Access Security
license
CASB-PA license
CASB-X
license
To help you quickly identify the GenAI applications that pose the greatest threats to
your organization,
AI Access Security
assigns each GenAI application a
risk score. These risk scores enable you to quickly identify risky AI apps, so you
can take action to protect your environment. For example, to protect your
environment, you could create a policy rule to block the application. You might also
choose to
tag the application as Unsanctioned.
An application's risk score is between 1 (low risk) and 5 (high risk) and is based on
application attributes. Some attributes are common to all SaaS applications, while a
subset of attributes are unique to GenAI applications.
GenAI attributes are attributes such as the data type for user input to
the application, the data type of the output generated by the application, and
whether user-submitted data is used by the application to train its GenAI models.
Based on GenAI attribute values, the risk score calculation determines the GenAI
risk.
In addition to the GenAI attributes, the risk score calculation uses the following
types of attributes to determine the application's general SaaS risk.
Compliance attributes, which identify whether an application
adheres to various regulatory requirements and standards.
Security and Privacy attributes, which identify product features
for protecting data. This category of attributes includes attributes such as
whether the application encrypts data at rest and data in transit.
A GenAI application's final risk score is a combination of the general SaaS risk
(calculated from SaaS attributes) and the GenAI risk (calculated from GenAI
attributes). The risk score calculation gives extra weight to the GenAI risk when
determining the final risk score.
