Run a scan across a large data estate and you get a number that means very little: tens of thousands of resources containing sensitive data. Most of it is fine. Some of it is an incident waiting to happen. Sensitivity alone can't tell you which is which.
A spreadsheet of Social Security numbers sitting in a private folder that two people can reach is not the same problem as the same spreadsheet behind an "anyone with the link" URL. Both are critical by sensitivity. Only one needs attention this afternoon.
Teleskope's Risk Score exists to close that gap.
Sensitivity Plus Exposure, In One Number
Risk Score combines two things Teleskope already knows about every resource: what sensitive data it contains, and who can reach it.
The sensitivity side draws on detected data elements and document types, along with the sensitivity assigned to those document types. A file with a hundred SSNs scores differently from one with a single email address. A document classified as a medical record scores differently from an untyped text file.
The exposure side draws on access signals - public links, organization-wide sharing, external collaborators, and the other ways a resource becomes reachable beyond its owner.
Those two dimensions combine into a single score and a tier, so a security team can sort an entire catalog by what actually warrants attention rather than working through an undifferentiated pile of critical findings.
Because Risk Isn't the Same at Every Company
The most important design decision in Risk Score is that none of the weighting is fixed. What's risky to a healthcare provider is not what's risky to a payments company.
Every input is tunable from a dedicated risk configuration page:
- The top-level balance between sensitivity and exposure, which defaults to 2:1 but can be shifted in either direction depending on whether your primary concern is what data you hold or where it's ended up
- Within sensitivity, how much data elements contribute relative to document types
- Within exposure, the individual weight of each exposure signal
Changes are previewed against your own data before they take effect, and every setting can be reverted or reset to defaults. Teams tend to start with the defaults, look at what surfaces, and adjust once they've seen how the score behaves against their own estate.
A Score You Can Argue With
A risk score that can't be explained is a risk score nobody trusts. If a resource is flagged, the obvious next question is why? "The model said so" is not an answer a security team can take to a data owner.
Every resource carries a Risk tab that decomposes its score into the specific factors that produced it: the exposure signals that applied, the data elements detected, the document types identified, and the sensitivity assigned to each. You can see not just that a file scored high, but which part of it did the work.
That matters for triage, and it matters more for the conversation afterward. When you ask a document owner to restrict a link, you can tell them exactly what's in the file and exactly who could reach it.
Compliance Frameworks as Risk Amplifiers
Risk Score is compliance framework aware - and the approach is deliberately different from a compliance checklist.
Teleskope supports GDPR, CCPA/CPRA, HIPAA, PCI DSS, and DPDP, each of which acts as an amplifier on a resource's base risk score rather than as a separate pass/fail verdict. When the combination of data elements, document types, and exposure signals on a resource matches the shape of a framework's concerns, that framework's amplifier increases the resource's score.
Three things worth understanding about how it works:
- Amplification is graduated, not binary. A file with a hundred SSNs saturates the GDPR amplifier far more than a file with a single email address. The framework doesn't simply apply or not apply - it applies in proportion to how much regulated exposure is actually present.
- Only the strongest framework applies. Since there's substantial overlap in what these frameworks care about, a resource matching both HIPAA and GDPR doesn't get both multipliers stacked. The strongest one wins. Stacking would produce scores that overstate risk for organizations subject to several overlapping regimes - which is most of them.
- You choose which frameworks matter. Frameworks are individually enabled, disabled, and weighted. An organization with no European data subjects shouldn't have GDPR inflating its scores, and a company outside healthcare shouldn't be seeing HIPAA amplification at all.
Where It Shows Up
Risk Score is live in the Data Explorer today, sortable and filterable alongside every other catalog attribute, with the Risk tab available on any resource you drill into.
It's also wired into Kosmo, Teleskope's AI agent orchestrator for data security, so questions like "what are my riskiest files" resolve against the score rather than against sensitivity alone.
Coming next: risk distribution and riskiest-resource views on the dashboard, risk scoring extended to identities rather than only resources, and historical risk snapshotting so teams can show risk reduction over time rather than only current state.
Available Now
Risk Score is live in the Data Explorer for supported connectors, to see it against your own data, book a call at teleskope.ai/book-a-call.
%20-%20Thumbnail_Wide.png)
