Predictive Risk Analysis
How the AI risk score, trend, and 30-day forecast work
Predictive Risk Analysis
The Predictive Risk Analysis panel (found at the bottom of the AI Automation tab) calculates a daily risk score for your domain, tracks whether that risk is improving or worsening, and forecasts where you'll be in 30 days — before problems become critical.
The Risk Score (0–100)
Your overall risk score combines four signals, each weighted by importance:
The percentage of your email that passes DMARC authentication. 100% compliance = zero risk from this factor. Below 95% will flag as an issue.
Lookup count, delegation status, circular references, and other SPF-specific issues. A healthy SPF record contributes zero risk here.
Unresolved anomalies detected by monitoring — volume spikes, sudden pass-rate drops, or suspicious new sources. High anomalies add 5 pts each, critical add 10 pts.
Sources sending email with zero authentication, or flagged as suspicious or unrecognised. Proportional to the share of your total sources.
Trend Direction
Trend is calculated using 7 or more days of historical snapshots. If fewer than 7 days exist, the panel shows "Insufficient history."
- ↓ Improving — risk score dropping more than 1 point/week on average
- → Stable — score holding steady (within ±1 pt/week)
- ↑ Degrading — risk score rising more than 1 point/week
The velocity label (e.g. "+2.3 pts/week") shows the rate of change. A negative velocity is good — your risk is falling.
30-Day Forecast
Once trend data is available, the panel projects your risk score 30 days forward by extrapolating the current velocity. If your trajectory crosses a risk level boundary (e.g. Medium → High), it flags this as a predicted issue so you can act before it happens.
The confidence percentage reflects data quality — more days of history and a consistent trend direction produce higher confidence.
AI Enhancement
For domains at HIGH or CRITICAL risk, or where the trend has been consistently degrading for 7+ days, AI analyses your 30-day compliance history, active anomalies, and source data to generate:
- A plain-English explanation of what is driving the risk
- Specific predicted issues (e.g. "DKIM selector misconfiguration will cause rejections")
- 2–3 concrete recommended actions
The AI enhanced badge appears when AI has contributed to the forecast. Low and medium risk domains with stable trends use rules-based forecasting only.
Dashboard Integration
The Actions Summary card on your main dashboard shows "High Risk Domains: N" whenever any of your domains are at HIGH or CRITICAL risk — keeping risk visible at the portfolio level without needing to check each domain individually.
How Often It Updates
Snapshots run once per day at 2:00 AM. The panel always shows the most recent completed snapshot — it does not recalculate in real time. Domains without DMARC report data are excluded until reports start arriving.