Entity Risk Assessment
Beyond per-event scoring, Quint evaluates the overall risk posture of agents, systems, and entire fleets. Entity assessment uses 8 dimensions computed from the complete behavioral graph.Assessment Levels
Agent Assessment (Level 2)
The most common assessment. Produces scores across 8 dimensions, each 0-100.Dimensions
| Dimension | Weight | Description |
|---|---|---|
| Historical Event Risk | 0.20 | EWMA of daily max scores (recent events weight more) |
| Privilege Footprint | 0.15 | Blast radius: resources, fields, servers, OAuth scopes |
| Behavioral Consistency | 0.15 | Action entropy, session variance, resource stability |
| Policy Compliance Rate | 0.15 | Violation frequency weighted by severity |
| Data Sensitivity Exposure | 0.10 | Highest-sensitivity data regularly accessed |
| External Communication Risk | 0.10 | Outbound data volume, unwhitelisted endpoints |
| MCP Trust Surface | 0.08 | Unverified servers, description changes, broad schemas |
| Trend Trajectory | 0.07 | Is the agent getting riskier or safer? |
Agent Composite Formula
Example Agent Profile
System Assessment (Level 3)
Aggregates agent scores and adds cross-agent signals:| Signal | Weight | Description |
|---|---|---|
| Weighted agent scores | 0.50 | Weighted by action volume |
| Cross-agent resource contention | 0.20 | Multiple agents accessing same sensitive resources |
| Shared MCP concentration | 0.15 | Single-point-of-compromise MCP servers |
| Delegation chain risk | 0.15 | Cross-agent delegation depth |
Fleet Assessment (Level 4)
CISO dashboard view across all agents and systems:Entity Risk Levels
| Score | Level | Meaning |
|---|---|---|
| 1-15 | Low | Operating within baseline |
| 16-35 | Moderate | Some drift, monitor |
| 36-60 | Elevated | Significant changes, investigate |
| 61-80 | High | Active risk, restrict permissions |
| 81-100 | Critical | Likely compromised, immediate action |
Assessment Triggers
| Trigger | Frequency |
|---|---|
| Scheduled (background) | Agent: 6h, System: 12h, Fleet: 24h |
| Threshold-triggered | On any event exceeding alert threshold |
| API-requested (on-demand) | GET /v1/assess/agent/{id}?window=30d |