> For the complete documentation index, see [llms.txt](https://aegisai-2.gitbook.io/aegisai-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aegisai-2.gitbook.io/aegisai-docs/core-mechanisms/risk-scoring-model.md).

# 📈 Risk Scoring Model

At the center of AegisAI’s decision logic is a dynamic risk scoring model.\
Its role is simple in principle, but critical in practice: to turn fragmented signals into a structured assessment of risk.

In Web3, a single event rarely tells the full story. A large transfer may be routine treasury management, or it may be the first step of an exploit. A new wallet may be harmless, or it may be part of a coordinated attack path. The difference lies in context.

The purpose of the scoring model is therefore not to label isolated actions as safe or unsafe, but to evaluate how multiple signals interact under real conditions.

#### From isolated signals to contextual judgment

Traditional monitoring systems often rely on thresholds.\
If transaction size exceeds a certain level, if liquidity drops below a predefined range, or if a wallet interacts with a flagged address, an alert is triggered.

That logic is useful, but incomplete. It treats risk as a binary condition, even though most real threats emerge gradually and across multiple layers.

AegisAI approaches this differently.\
Its model assigns weighted importance to a set of inputs and continuously recalculates risk as conditions change. The result is not a static label, but a live probability-based assessment.

#### Core scoring dimensions

The model draws from several categories of intelligence:

| Dimension             | What it reflects                                                              |
| --------------------- | ----------------------------------------------------------------------------- |
| Wallet Behavior       | transaction history, interaction patterns, approval activity, abnormal timing |
| Protocol State        | contract exposure, liquidity shifts, governance changes, pool imbalance       |
| Market Context        | volatility, execution pressure, unusual volume, price distortion              |
| Transaction Structure | routing complexity, clustering, sequencing, value concentration               |
| Cross-Chain Activity  | bridge usage, asset migration, multi-network continuity                       |

Each category contributes a partial view of risk.\
The scoring model is what brings them together into a unified interpretation.

#### A contextual rather than fixed system

Not every signal carries the same meaning in every environment.\
A rapid withdrawal during a stable market may be normal portfolio rotation. The same behavior during a sharp volatility event, combined with bridge movement and abnormal wallet coordination, may point to elevated risk.

This is why the model is contextual rather than fixed.\
Weights are adjusted depending on the surrounding environment, allowing the system to distinguish between noise and meaningful threat formation.

#### Risk levels as operational states

The output of the model is not only a score, but an operational state that can inform the rest of the system.

A simplified structure may look like this:

* **Low Risk**\
  normal activity, continue monitoring
* **Moderate Risk**\
  unusual behavior detected, increase observation and correlation
* **High Risk**\
  multiple aligned signals, activate defensive plugins and alerts
* **Critical Risk**\
  coordinated or exploit-like behavior, trigger real-time protection pathways

This structure allows the score to function not just as an analytical output, but as a trigger for action.

#### Why scoring matters

A good risk model does more than rank transactions.\
It helps the system prioritize attention, allocate protective resources, and avoid two common failures: overreaction and underreaction.

If everything unusual is treated as dangerous, the system becomes noisy and unusable.\
If only obvious threats are flagged, real attacks arrive too late.

The scoring model exists to balance that tension.\
It gives AegisAI a way to interpret uncertainty without collapsing into either passivity or alarm fatigue.

#### Learning over time

Because Web3 risk evolves, the scoring model cannot remain static.\
As new exploit patterns appear and new forms of coordination emerge, the model must adapt. This means recalibrating signal weights, improving sensitivity under different market conditions, and learning from both confirmed incidents and false positives.

Over time, this allows the model to become more precise without becoming more rigid.

#### Strategic role in the system

Within AegisAI, the risk scoring model acts as the bridge between intelligence and execution.\
It takes raw interpretation from the Data & AI layer and turns it into something operationally meaningful for plugins, alerts, and protocol integrations.

In that sense, it is not just a measurement tool.\
It is the mechanism that allows the system to decide when risk is forming, how serious it is, and what should happen next.