Relevancy Calculation

How Relevancy Calculation Works

Relevancy calculation is a ranking method, not a verdict. It scores items against the context of an investigation so analysts can sort what is likely important from what is merely adjacent, incomplete, or low-confidence noise.

The useful idea is that “relevant” is contextual. A weak signal can become valuable when it aligns with the asset, threat pattern, time window, or incident hypothesis already under review, while a strong-looking event can fall lower if it does not fit the current case.

What Inputs Make the Score Useful

A good relevancy model usually blends multiple signals rather than relying on one. Source confidence, asset criticality, behavioural match, and current exposure are all examples of inputs that can change the result in meaningful ways.

That matters because each input answers a different question. Confidence asks whether the data is trustworthy, criticality asks how important the target is, behavioural match asks whether the item resembles the pattern being sought, and exposure asks whether it is currently actionable.

Why Relevancy Calculation Matters in Security Operations

Security teams rarely suffer from a lack of data, they suffer from too much of it. Relevancy calculation helps reduce alert fatigue by pushing likely priority items to the top and letting analysts spend less time on low-value matches that do not advance the investigation.

It is especially useful when different data sources produce very different levels of detail. A tuning approach that works for one asset class or use case can mis-rank another, so the score must be tied to the operational context rather than treated as a universal truth.

How to Interpret and Tune the Result

The score should be treated as a decision aid that reflects current assumptions, not a permanently correct measure. If the model keeps surfacing the wrong items, the problem is often in the weighting, the context definition, or the quality of the underlying enrichment data rather than in the ranking idea itself.

Good tuning usually means checking whether the score rewards evidence that actually helps the investigation. If the system overvalues noisy indicators or underweights asset importance, it will look active while producing poor analyst outcomes.

Risk and Threat Considerations

Relevancy scoring can be manipulated or made misleading when attackers understand what the ranking system values. If exposure, behaviour, or confidence signals are incomplete or easy to distort, low-quality activity can be promoted, while real compromise can be buried under noisy but better-scoring records.

Failure mechanism: weak telemetry, stale asset context, or adversary-controlled similarity signals can cause the ranking engine to prioritise the wrong events and delay investigation.

Impact: analysts may miss early compromise, spend time on false leads, or make poor containment decisions because the most important items were not surfaced first.

Practitioner Guidance

Why practitioners should care: the value of a relevancy score depends on the investigation it supports, so it should be validated against real analyst workflow rather than accepted as a generic optimisation metric. A score that looks mathematically consistent can still be operationally unhelpful if it does not match how teams triage incidents.

What to watch for: repeated disagreement between ranked output and analyst judgement is usually a sign that one of the inputs is too blunt, too stale, or too easy to game. The practical test is whether the score consistently improves prioritisation for the same asset, threat, or case type.

Related resources from NHI Mgmt Group

• What is the difference between changing a permission calculation and changing stored authorization data in SpiceDB?
• What is the difference between a regular container vulnerability scan and a relevancy-focused scan?
• What is the difference between the EDPB’s fine-calculation framework and the final amount a regulator may impose?
• What do organisations get wrong when they treat LGPD fine calculation as a simple percentage formula?