---
title: Create an application vulnerability calculator
description: An application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item \(AVI\) Risk Score, can contain Risk Rules. Risk calculations offer insight in prioritizing remediation.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/avm-create-calculator.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 4
breadcrumb: [Calculate risk in Application Vulnerability Response automatically, Use, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create an application vulnerability calculator

An application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item \(AVI\) **Risk Score**, can contain **Risk Rules**. Risk calculations offer insight in prioritizing remediation.

## Before you begin

Role required: App-Sec Manager group

**Note:** You may notice performance degradation when running application vulnerability calculators that contain scripts.

Order your rules to run the simplest rules first. Only run scripts on the items that cannot be handled with a condition and template value or a risk rule.

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Vulnerability Calculators**.

2.  Click **New**.

3.  Fill in the fields on the form, as appropriate.

    |Field|Description|
    |-----|-----------|
    |Name|The name of the application vulnerability calculator.|
    |Table|Auto-filled with the name of the AVI table.|
    |Application|Auto-filled with Vulnerability Response.|
    |Target field|Field to calculate.|
    |Description|Text description of the calculator.|
    |Active|Turn the calculator on or off.|

4.  Right-click in the header to **Save**.

    The **Vulnerability Calculator Rules** section appears.

5.  Create a rule for the calculator by clicking **New**.

    **Note:** For the **New Risk Rules** form \(only available when the **Target field** is **Risk Score**\) see step 10.

6.  Fill in the fields, as appropriate.

    |Field|Description|
    |-----|-----------|
    |Name|Name of the calculator rule.|
    |Order|The order in which to run the vulnerability calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.|
    |Calculator|Auto-filled with the calculator parent.|
    |Active|By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.|
    |Advanced view|When selected, scripted conditions and scripted values can be selected from **Condition type** and **Value type**.|

7.  Fill in the fields in the **When this condition is met** tab, as appropriate.

<table id="table_xl5_43j_tw"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Condition type

</td><td>

Available when you select the **Advanced view**. Choices include: -   Filter: Uses filter conditions.
-   Filter group: See [create and define filter groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-filter-group.md) to define the calculator criteria.
-   Script: Script condition used to determine when to apply this calculator.

**Note:** Before you write scripts for determining when to apply the calculators, return to the **Application Vulnerability Calculators** list. Explore the vulnerability calculator records shipped with the base system.

</td></tr><tr><td>

Condition

</td><td>

Defines basic filter conditions for determining whether to use the calculator or not. Selecting either the **Filter group** or **Script** condition types, hides this field.

</td></tr></tbody>
</table>8.  Click the **Set these values** tab and fill in the fields on the form, as appropriate.

<table id="table_p2z_4jj_tw"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Value type

</td><td>

Available when you select the **Advanced view**. Choices include: -   Template: Define the values to set on each field.
-   Script: Used to set the values on each field.


</td></tr><tr><td>

Script values

</td><td>

Available if you selected the **Script** value type.Defines what values to apply the calculations to.

</td></tr><tr><td>

Template

</td><td>

Select the fields and values you want to use for the calculator. Selecting either the **Script** value type, hides this field.

</td></tr></tbody>
</table>9.  When you have completed all entries, click **Submit**.

    **Note:** When you edit an existing calculator, and you want to update all existing scores, you can use the **Reapply Calculator** button. It runs through all active AVIs, and if that calculator would be used to set its value, recalculates the value for those AVIs. Since reapplying a calculator can take a long time, a scheduled job handles it.

10. For the **New Risk Rules** form, fill in the fields as appropriate.

    Set each weight according to the percentage of the result that should come from that value. For any data that your scanner does not provide, or for data that should not be part of the risk score, set the weight to zero.

    As you update the weights, scenarios display the weights remaining, as well as anticipated **Risk Score** results.

<table id="table_r41_lxq_lhz"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the calculator rule.

</td></tr><tr><td>

Order

</td><td>

The order in which to run the calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.

</td></tr><tr><td>

Calculator

</td><td>

Auto-filled with the calculator parent.

</td></tr><tr><td>

Active

</td><td>

By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.

</td></tr><tr><td>

Condition

</td><td>

Defines basic filter conditions for determining whether to use the calculator. Selecting either the **Filter group** or **Script** condition types, hides this field.

</td></tr><tr><td colspan="2">

**Weights**

</td></tr><tr><td>

Vulnerability Severity

</td><td>

Percentage of the result that comes from severity.

</td></tr><tr><td>

OWASP top 10

</td><td>

Percentage of the result that comes from the vulnerability's presence in the OWASP top 10 list. If this information is not present in your vulnerabilities, set the weight to zero.

</td></tr><tr><td>

SANS top 25

</td><td>

Percentage of the result that comes from the vulnerability's presence in the SANS top 25 list. If this information is not present in your vulnerabilities, set the weight to zero.

</td></tr><tr><td>

Running total

</td><td>

Auto-computed percentage totals. When this value reaches 100, the Scenario preview shows sample risk scores in different scenarios.

</td></tr><tr><td>

Sample scenarios

</td><td>

When all weights total 100%, risk score scenarios display, providing a preview of the risk score in some of the possible scenarios.

</td></tr></tbody>
</table>    \[Omitted image "RiskRuleCI.png"\] Alt text: Vulnerability Risk Rule example

11. Click **Submit**.