Microsoft patents method to score security risks using data from other systems
Microsoft describes a system that calculates a security risk score for a specific computer component by looking at how similar issues affected other customers in the past. It combines a base risk score for the component with an estimated impact based on historical data from other users to create a final risk rating.
In the filing’s own words
A system identifies a security issue instance arising in a computing component of a tenant computing system, assigns a component security issue score to the security issue instance indicating a level of risk of the security issue instance arising from the computing component, and retrieves tenant context scores corresponding to other security issue instances of the security issue type historically arising in computing components of a plurality of other tenant computing systems and representing levels of risk to the plurality of other tenant computing systems by the other security issue instances. The system assigns an imputed tenant context score for the tenant computing system based on the tenant context scores for the plurality of other tenant computing systems and calculates the system security risk score for the tenant computing system for the security issue instance based on modification of the component security issue score using the imputed tenant context score.
What exactly they claim (claim 1)
1. A computer-implemented method of generating a system security risk score representing an impact to a tenant computing system of a security issue instance of a security issue type, the security issue instance arising in a computing component of the tenant computing system, the computer-implemented method comprising: identifying the security issue instance arising in the computing component of the tenant computing system; assigning a component security issue score to the security issue instance, the component security issue score indicating a level of risk of the security issue instance arising from the computing component; retrieving tenant context scores corresponding to other security issue instances of the security issue type historically arising in computing components of a plurality of other tenant computing systems, the tenant context scores representing levels of risk to the plurality of other tenant computing systems by the other security issue instances of the security issue type, the plurality of other tenant computing systems being different from the tenant computing system; determining an imputed tenant context score for the tenant computing system based on the tenant context scores for the plurality of other tenant computing systems; and calculating the system security risk score for the tenant computing system for the security issue instance based on modification of the component security issue score using the imputed tenant context score.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- COMPUTING COMPONENT-BASED SECURITY RISK SCORING
- Publication number
- US20260300495A1
- Application number
- 19092053
- Filed
- Mar 27, 2025
- Published
- Oct 1, 2026
- Inventors
- 5
- Claims
- 20
Classified under
G06F 21/577 Physics & computingG06F 2221/034 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.