Script Risk
Understand Enterprise script risk scores from 0 to 100, incomplete assessments, and the activity observed in the Script Risk tab.
Open a script from Scripts, then select Script Risk alongside Insights, Served Hashes, Seen Pages, and Script History. This tab shows the resources cside observed the script loading and the page data it accessed.
Risk score
Numeric script risk scores and risk-based sorting are available only on the Enterprise plan. cside must also enable the preview for your team. If you do not see Risk score, contact cside to check your team’s access.
0 means lower risk. 100 means higher risk. Use the score to prioritize scripts for review. It is not a probability of compromise: a score of 45 does not mean a 45% chance of an attack. Legitimate payment or authentication scripts can score higher because they access sensitive data. A low score does not guarantee safety.
Find and sort scores
In a domain’s Scripts list or the all-domains list, use the Risk score column and sort by known risk, highest or lowest first. Scripts without an assessment appear last in either direction. Select a score to open its explanation in Script Risk.
A grouped row shows the highest known score or minimum among its member URLs. Selecting it opens the contributing script. If any member is unassessed or has incomplete evidence, the group remains incomplete.
Understand score states
| What you see | What it means |
|---|---|
| A number out of 100 with Low risk, Medium risk, or High risk | The assessment has a numeric score. Higher numbers mean higher risk. |
| Insufficient data and At least N/100 | The available evidence establishes a minimum. Missing evidence prevents a full score. |
| Pending | No assessment has been saved for this script in the current assessment window. It does not mean zero risk. |
| Unavailable | cside could not load the assessment. It does not mean zero risk. |
| Stale | The evidence window is no longer current. The displayed score or minimum still describes that older window. |
For example, At least 45/100 means the known evidence already establishes a risk score of at least 45. The full score may be higher. It does not mean that 45% of the evidence has been collected.
An assessment can show 100/100 while still marking evidence as incomplete: the known evidence already reaches the maximum, so missing evidence cannot raise the score further.
What contributes to the score
The explanation separates six behavior factors:
- Form-field access: the most sensitive field category observed, such as personal data, credentials, or payment details.
- Sensitive browser APIs: evidence of camera, microphone, location, or clipboard use. An observed call attempt does not prove permission was granted or data was returned.
- Loaded resources: the distinct destinations used for active and passive resources.
- Iframes: evidence of embedded frames, including their origin relationship when known.
- Content changes: distinct script content revisions in the assessment window.
- First observed: how recently cside first observed the script relative to the end of that window.
Security findings can establish a minimum score. The result uses the higher of the behavior total and the strongest applicable security minimum; these values are not added together. Unresolved findings remain visible. This preview helps you review scripts and does not change alerts or blocking rules.
Why evidence can be missing
The preview does not yet verify complete browser monitoring or security-check coverage for every script revision. You can therefore see Insufficient data even when cside has saved observations successfully. The absence of recorded activity does not prove that nothing happened.
Other gaps include incomplete revision history, too little retained history to establish when a script was first seen, unavailable collection, or a failed data read. Each factor explains its missing evidence. These gaps are not treated as zero risk, and refreshing the page does not fill them. Contact cside if assessments remain Pending or a source stays unavailable.
Assessment window and first-observed time
Scores cover seven complete UTC days, excluding the current day. A script first seen today can remain Pending until a later assessment includes it. Date and revision filters do not change this fixed window, including the date picker on the behavior tables below.
The explanation shows the actual window and calculation time in your local time zone. First-observed durations use days, hours, and minutes as needed, such as 25 days, 13 hours instead of 613 hours. This duration is measured at the end of the assessment window, not when you open the page.
Observed behavior
Both tables show enforcement as Permitted, Blocked, or a percentage blocked, based on Vendor Permissions, along with when the activity was last observed. Accessed-field rows include the field kind and risk level. Expand them for page-level create, read, update, or delete activity. No recorded activity means cside has no observations in that window, not that it captured every possible action.
Date range
Both tables on this tab share a date range picker anchored to the script’s last-seen date. The available range is bounded by whichever is narrower: your plan’s retention window, or the dates cside actually observed the script. Requesting a range outside that window shows a “No recorded behavior in this range” message instead of empty tables.
Loaded resources
The loaded resources table lists one row per host and resource kind the script caused to load, for example a script loading a tracking pixel from a specific hostname, or fetching data from an API endpoint.
Each row shows:
- A color-coded tile for the resource kind: Connect/XHR, Script, Object, Frame, Image, Style, Font, Media, Worker, Manifest, or Prefetch
- The hostname, with its favicon and full country name when known
- Whether the load was allowed or blocked
Expand a row to see the pages the resource was seen on, sample URLs, and an estimated-location map built from where the resource was observed.
Filtering loaded resources
Two chip groups sit above the table:
- Enforcement: filter to allowed or blocked loads
- Kind: filter to a specific resource kind, with a count shown on each chip
Kind counts reflect your enforcement filter but not your kind selection, so the counts stay stable as you switch between kinds and only change if you toggle Allowed or Blocked.
Accessed fields
The accessed fields table lists the page fields and data the script has read, for example form inputs or storage values. Each row shows the field’s kind, a risk badge, whether access was allowed or blocked, and a sample of the pages it was seen on. Expand a row to see the script’s activity on each page individually.
Script Risk covers one script’s own activity. For the cross-script, team-wide view of every resource cside has observed across your domains, see Resources Inventory.
Related pages
Thanks for your feedback!