> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Risk Detection


Enterprise Edition

**Risk Detection** requires JumpServer Enterprise Edition. Without a license, the Security > Risk Detection tabs are disabled.

[Request 14-day free trial](https://www.jumpserver.com/free-trial)

Risk Detection checks the credentials of accounts already managed by JumpServer for weaknesses such as short or simple passwords, passwords reused across accounts, and passwords that appear in common leak lists. It does not connect to assets to discover accounts; the accounts must already be inventoried and have credentials configured.

Use it together with [Discover Accounts](https://www.jumpserver.com/docs/features/pam/automation/discover-accounts.md) when you need to compare managed accounts against what actually exists on the servers.

## Prerequisites

- Access to **PAM > Security > Risk Detection** with permission to view detection results and tasks.
- Target assets or nodes exist and their accounts are managed with credentials. See [Accounts](https://www.jumpserver.com/docs/features/console/accounts/index.md).
- At least one detection engine is enabled.

## Overview

The page contains four tabs:

- **Detection results** – risks found by executed detection tasks.
- **Detection tasks** – task definitions and their schedule.
- **Execution history** – per-run status, duration, and log.
- **Detection engines** – the checks available in this environment.

![Figure 1: Detection results grouped by asset with risk and status columns](/images/v5/jumpserver/v5_admin_risk_01.png)

## Create a detection task


1

At the top-left of the page, select , then click  **PAM**.

![image](/docs/images/docs/navs/nav-pam.png)

2

Open **Security > Risk Detection** and select **Detection tasks**.

3

Click 
**Create**
.

4

In the 
**Name**
 field, type the task name.

5

In the **Assets** and **Nodes** fields, select the scope to check. The two
fields can be combined.

6

In the **Engines** field, select one or more detection engines. This field is
required.

7

Optionally select **Recipients** to receive the result by email. Only email
delivery is supported.

8

Optionally enable **Periodic** and set **Interval** or **Crontab**. Keep
**Active** selected and click **Submit**.

## Field reference

| Field              | Description                                                           |
| ------------------ | --------------------------------------------------------------------- |
| **Name**           | Required. Task name.                                                  |
| **Assets / Nodes** | Assets and nodes whose accounts are checked; both can be selected.    |
| **Engines**        | Required. One or more detection engines.                              |
| **Recipients**     | Users notified by email after execution.                              |
| **Periodic**       | Repeats the task on a schedule; crontab takes priority over interval. |
| **Active**         | Enables the task.                                                     |
| **Comment**        | Optional notes.                                                       |


Note

An engine only inspects credentials that are stored in JumpServer. If an
account exists on the asset but has never been added to the inventory,
detection cannot see it. Run a discovery task first.

![Figure 2: Create detection task drawer](/images/v5/jumpserver/v5_admin_risk_04.png)

## Review and resolve results

Open **Detection results** after a task has run. The left side is an asset tree with summary counts for the last week, the last month, and pending risks; the table lists **Asset**, **Account**, **Risk**, **Pending**, and **Date created**.

For a pending risk, open the **Actions** menu in the **Pending** column and choose the action that matches the finding:

| Action                                        | When it applies                                                                      |
| --------------------------------------------- | ------------------------------------------------------------------------------------ |
| **Change password**                           | Weak, leaked, repeated, expired, or long-time passwords. Rotates the account secret. |
| **Add account** / **Change password and add** | Accounts that exist on the asset but are not yet managed in JumpServer.              |
| **Sync delete selected** / **Delete account** | Accounts flagged as deleted or no longer used.                                       |
| **Review**                                    | Group, sudo, or authorized-key changes. Opens the detail view.                       |
| **Ignore** / **Reopen**                       | Accepts the risk, or returns a resolved risk to pending.                             |

From the review view, **Close** confirms the finding and moves the status to confirmed, while **Ignore alert** marks it ignored. To handle several findings at once, select the rows and choose **Resolve selected**.

## Detection engines

The **Detection engines** tab lists the engines available in the current environment:

| Engine                                                  | What it checks                                                        |
| ------------------------------------------------------- | --------------------------------------------------------------------- |
| Check the strength of your account password             | Password strength and whether the credential appears to be exposed.   |
| Check whether account and password are repeated         | Whether the same username and password are reused by another account. |
| Check whether the account password is a common password | Whether the password appears in lists of commonly leaked passwords.   |

Enabled engines are selected per task, so you can run a lightweight strength-only check daily and a full check on a weekly schedule. Review the result list periodically; a clean run does not prove that every asset account is healthy, only that the managed credentials passed the selected checks.