[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[],[],null,["# Risk reports overview\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\n| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nThis page provides an overview of risk reports and the data that is included in\nthem.\n\nRisk reports help you understand the results of the attack path simulations that\nSecurity Command Center runs. A risk report starts with a high-level overview, and\nthen the report provides details of sample toxic combinations and associated\nattack paths.\n\nWhen to use risk reports\n------------------------\n\nYou can access risk reports in the\nGoogle Cloud console. However, you must have [a role with specific permissions](/security-command-center/docs/download-risk-reports#before-you-begin) to download a PDF copy\nof a risk report. A risk report is useful if you want to share a high-level\nview of the security landscape of your environment.\n| **Note:** Risk reports only display data for resources in Google Cloud.\n\nSections included in risk reports\n---------------------------------\n\nRisk reports provide a snapshot of data about your environment in the following\nsections, ordered to match the layout of the generated report:\n\n### Risk Engine introduction\n\nThis section provides an overview of the results of the attack path simulations,\nincluding explanations of high-level concepts and how the\n[Risk Engine](/security-command-center/docs/attack-exposure-supported-features)\nworks.\n\n- **High-value resource set**: Indicates whether you created resource value configurations.\n- **Valued resources assigned**: Summarizes the valued resources assigned in the latest simulation and the number of resources per resource type.\n- **Your risk exposure** : Refers to the following:\n - The number of successful attack paths.\n - The number of exposed resources with a score that is greater than zero.\n - A breakdown of exposed valued resources with `HIGH`, `MEDIUM`, or `LOW` ratings. See [Priority\n values](/security-command-center/docs/attack-exposure-learn#priority-values-manual) for more information.\n\n### Entry points and chokepoints\n\nThis section summarizes entry points and chokepoints, including suggested\nmitigations and accompanying descriptions.\n\n- **Attacker entry points** : This diagram represents common entry points across attack paths. An entry point is the starting point of an attack. The width of the nodes in the diagram indicates their frequency. For more information, see [Types of\n nodes](/security-command-center/docs/attack-exposure-learn#types_of_nodes).\n- **Entry Point** table: The entry point table provides all entry points that exist in the attack path simulations, grouped by types. This table also includes the entry point frequency and a short description.\n- **Attack path chokepoints**: This diagram shows the top five chokepoints with the highest score. A chokepoint is a resource or resource group where high-risk attack paths converge. If you address these chokepoints, you can mitigate many attack exposures. This section shows the most frequent chokepoints, their resource type, and the general mitigation information.\n- **Top chokepoints and suggested mitigations**: This table provides information about the top four chokepoints with the highest scores and suggested mitigations.\n\n### Toxic combination details\n\nThis section provides a detailed look into the toxic combination with the\nhighest score.\n\n- **Toxic combination example**: Toxic combinations are a group of security\n issues that, when they occur together in a particular pattern, create a path\n to one or more of your high-value resources that a determined attacker could\n potentially use to compromise those resources.\n\n The diagram in the report shows an example attack path from one toxic\n combination to visualize how an attacker could reach a high-value resource\n through a combination of attack paths.\n- **Toxic combination description**: This section provides a brief description\n of the toxic combination in question.\n\n- **Remediate the above toxic combination**: The remediation steps show\n examples of suggested short-term and long-term remediation steps for the\n toxic combinations.\n\n### Toxic combination across your environment\n\nThis section provides an overview of the top toxic combinations. It also\nprovides an overview of the types of attack steps that appear most in the attack\npaths.\n\n- **Toxic combination categories with highest scored issues**: This section displays the number of toxic combinations identified in multiple categories, including count per toxic combination category and the highest score of the toxic combination in each category. This list helps you focus remediation efforts across categories.\n- **Toxic combinations with the highest exposure scores**: Specific toxic combinations and their primary resource name, type, and exposure score.\n- **Attack step method breakdown** : Attack steps that are common across all attack paths and how these steps map to the [MITRE ATT\\&CK\n framework](https://attack.mitre.org/). The **Frequency** column indicates what percentage of attack paths they appear in.\n\n### System attack exposure\n\nThis section summarizes your organization's exposure score and the percentage of\nyour exposed resources over time. You can see how risk is distributed over\nprojects and which projects and resources have the highest exposure scores.\n\nWhat's next\n-----------\n\nFor more information about what is presented in the risk reports, see the\nfollowing documentation:\n\n- [Download risk reports](/security-command-center/docs/download-risk-reports)\n- [Risk Engine feature support](/security-command-center/docs/attack-exposure-supported-features)\n- [Toxic combinations and chokepoints overview](/security-command-center/docs/toxic-combinations-overview)\n- [Attack exposure scores and attack paths](/security-command-center/docs/attack-exposure-learn)"]]
