---
title: Create a Vulnerability Response calculator
description: A vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the vulnerable item Risk Score, can contain Risk Rules.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/create-vul-calculator.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 6
breadcrumb: [Additional Vulnerability Response setup and configuration tasks, Vulnerability Response implementation, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create a Vulnerability Response calculator

A vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the vulnerable item **Risk Score**, can contain **Risk Rules**.

## Before you begin

Role required: sn\_vul.vulnerability\_admin or sn\_vul.admin \(deprecated\)

Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).

**Note:** You may notice performance degradation when running vulnerability calculators that contain scripts.

Order your rules to run the simplest rules first and only run scripts on the items that cannot be handled with a condition and template value or a risk rule.

## Procedure

1.  Navigate to **All** > **Vulnerability** > **Administration** > **Vulnerability Calculators**.

2.  Click **New**.

3.  Fill in the fields on the form, as appropriate.

    |Field|Description|
    |-----|-----------|
    |Name|The name of the vulnerability calculator.|
    |Table|Auto-filled with the name of the vulnerable item table.|
    |Application|Auto-filled with Vulnerability Response.|
    |Target field|Field to calculate.|
    |Description|Text description of the calculator.|
    |Active|Turn the calculator on or off.|

4.  Right-click in the header to **Save**.

    The **Vulnerability Calculator Rules** section appears.

5.  Create a rule for the calculator by clicking **New**.

    **Note:** For the **New Risk Rules** form \(only available when the **Target field** is **Risk Score**\) see step 10.

6.  Fill in the fields, as appropriate.

    |Field|Description|
    |-----|-----------|
    |Name|Name of the calculator rule.|
    |Order|The order in which to run the vulnerability calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.|
    |Calculator|Auto-filled with the calculator parent.|
    |Active|By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.|
    |Advanced view|When selected, scripted conditions and scripted values can be selected from **Condition type** and **Value type**.|

7.  Fill in the fields in the **When this condition is met** tab, as appropriate.

<table id="table_xl5_43j_tw"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the calculator rule.

</td></tr><tr><td>

Order

</td><td>

The order in which to run the vulnerability calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.

</td></tr><tr><td>

Calculator

</td><td>

Auto-filled with the calculator parent.

</td></tr><tr><td>

Active

</td><td>

By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to vulnerable items created in the system.

</td></tr><tr><td>

Advanced view

</td><td>

When selected, select scripted conditions and scripted values from **Condition type** and **Value type**.

</td></tr><tr><td>

Condition type

</td><td>

Available when you select the **Advanced view**. Choices include: -   Filter: Uses filter conditions.
-   Filter group: See [create a new filter group](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-filter-group.md) to define the calculator criteria.
-   Script: Script condition used to determine when to apply this calculator.

**Note:** Before you write scripts for determining when to apply the calculators, return to the **Vulnerability Calculators** list. Explore the vulnerability calculator records shipped with the base system.

</td></tr><tr><td>

Condition

</td><td>

Defines basic filter conditions for determining whether to use the calculator or not. Selecting either the **Filter group** or **Script** condition types, hides this field.

 Case sensitivity for the search text you enter in the condition builder is not supported on this record or form.

</td></tr></tbody>
</table>8.  Click the **Set these values** tab and fill in the fields on the form, as appropriate.

<table id="table_p2z_4jj_tw"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Value type

</td><td>

Available when you select the **Advanced view**. Choices include: -   Template: Define the values to set on each field.
-   Script: Used to set the values on each field.


</td></tr><tr><td>

Script values

</td><td>

Available if you selected the **Script** value type.Defines what values to apply the calculations to.

</td></tr><tr><td>

Template

</td><td>

Select the fields and values you want to use for the calculator. Selecting either the **Script** value type, hides this field.

</td></tr></tbody>
</table>9.  When you have completed all entries, click **Submit**.

    **Note:** When you edit an existing calculator, and you want to update all existing scores, you can use the **Reapply Calculator** button. It runs through all active vulnerable items \(VIs\), and if that calculator would be used to set its value, recalculates the value for those VIs. Since reapplying a calculator can take a long time, a scheduled job handles it.

10. For the **New Risk Rules** form, fill in the fields as appropriate.

    Set each weight according to the percentage of the result that should come from that value. For any data that your scanner does not provide, or for data that should not be part of the risk score, set the weight to zero.

    You can add, delete, or update the fields. You can also configure the weightage percentage for the field values. For more information, see [Define fields and weights for the risk rule for Vulnerability Response Risk Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calc-define-risk-rule-fields.md).

    As you update the weights, scenarios display the weights remaining, as well as anticipated **Risk Score** results.

<table id="table_r41_lxq_lhz"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the calculator rule.

</td></tr><tr><td>

Order

</td><td>

The order in which to run the vulnerability calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.

</td></tr><tr><td>

Calculator

</td><td>

Auto-filled with the calculator parent.

</td></tr><tr><td>

Active

</td><td>

By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.

</td></tr><tr><td>

Condition

</td><td>

Defines basic filter conditions for determining whether to use the calculator. Selecting either the **Filter group** or **Script** condition types, hides this field.

</td></tr><tr><td colspan="2">

**Weights**

</td></tr><tr><td>

Vulnerability Severity

</td><td>

Percentage of the result that comes from severity.

</td></tr><tr><td>

Vulnerability EPSS Score

</td><td>

Probability of the vulnerability being exploited. By default, the weight of this criteria is zero. If you want to use this for your risk score calculation, set an appropriate weight against this criteria.

</td></tr><tr><td>

Exploit exists

</td><td>

Percentage of the result that comes from the existence of an exploit. If this information is not present in your vulnerabilities, set the weight to zero.

</td></tr><tr><td>

Exploit skill level

</td><td>

Percentage of the result that comes from the skill level required by the exploit. If this information is not present in your vulnerabilities, set the weight to zero.

</td></tr><tr><td>

Exploit attack vector

</td><td>

Percentage of the result that comes from where the attack is targeted. If this information is not present in your vulnerabilities, then set weight to zero.

</td></tr><tr><td>

Service Business criticality

</td><td>

Percentage of the result that comes from business criticality. If you have not linked your CIs to business services, then set weight to zero.

</td></tr><tr><td>

CI Exposure

</td><td>

Percentage of the result that comes from whether the CI is internet-facing. If the weight is non-zero, a condition filter appears to define which CI are internet-facing. Set the filter to select your Internet-facing configuration items. You can preview which records match the condition.

</td></tr><tr><td>

Running total

</td><td>

Auto-computed percentage totals. When this value reaches 100, the Scenario preview shows you sample risk scores in different scenarios.

</td></tr><tr><td>

Risk score scenarios

</td><td>

When all weights total 100%, risk score scenarios display, providing a preview of the risk score in some of the possible scenarios.

</td></tr></tbody>
</table>    You can add or remove criteria, and adjust the weight of each criteria using the Embedded list.

    \[Omitted image "risk-rule-CI-v20.png"\] Alt text: Risk rule CI for version 20.

11. Click **Submit**.