Explain how risk scoring works in Google SecOps?

Risk scoring assigns a prioritization score to alerts and entities based on contextual vulnerability and business risk factors, aiming to help analysts focus attention on the threats that genuinely matter most rather than treating every alert as equally urgent.

Rather than relying purely on a detection rule's static severity label, risk scoring incorporates broader context — how sensitive or exposed the affected asset is, whether the entity involved has a history of suspicious activity, and how the specific detected behavior maps to real business impact — producing a more dynamic prioritization signal than severity alone would provide.

This directly addresses a common SOC problem: alert fatigue from a high volume of technically-valid-but-low-priority detections drowning out the smaller number that actually warrant urgent investigation; by escalating based on contextual risk rather than uniform severity, an analyst's limited attention gets routed toward alerts where the underlying asset, entity, and behavior combination genuinely represents meaningful business risk.