Snyk rebuilt its AI model risk scoring in Evo to provide context-aware risk scores for every deployed model. The new approach calculates a real risk score using Likelihood × Impact, where Likelihood comes from Attack Success Rate (ASR)—the share of real adversarial attacks that succeed—and Impact measures the damage from an attacker's goal. These are combined into a single score from 0 to 1000 (lower is better), ensuring that rare-but-catastrophic attacks are discounted by low likelihood and common-but-harmless ones by low impact. ASR is derived from real adversarial testing, including extraction prompts, multi-turn escalation, persona-based jailbreaks, and tree-of-attack strategies, with model-based judges confirming attack success. Every attack runs against a baseline system-prompt hardening defense, so the score reflects what gets through standard guardrails in production. The score is impact-oriented and breaks down to specific attacker goals, such as PII extraction, system-prompt extraction via injection, and insecure code generation, showing exactly where a model is weak. This replaces the previous approach of assigning a severity label, which left security teams asking what an "information disclosure" issue meant and what to do about it. Concrete numbers were shown on customer calls, including GPT-3.5 at a 397/1000 Unsafe Content score and GPT-4 at 3.