How scoring works

Every finding gets one priority score from five weighted components. The formula is visible, the weights are yours to tune, and every score — past and present — shows the exact inputs and weights used when it was calculated. There is no machine-learning black box to trust; there is arithmetic to check.

The five components

• Exploitability — is this class of vulnerability being exploited in practice? Informed by signals such as the CISA KEV catalogue and EPSS.
• Reachability — can an attacker plausibly reach the affected code or asset?
• Business context — how critical is the affected asset? Driven by the tier (A–D) you assign to each target.
• Cost of delay — what does waiting cost? Exposure grows with time for some classes far more than others.
• Remediation effort — cheap fixes to serious problems rise; expensive fixes to marginal problems fall.

Weights and versioning

The five weights must sum to one and are edited on the Scoring page (AppSec Lead only). Saving creates a new version rather than overwriting — the prior configuration is preserved, and each historical score keeps a copy of the weights used at the time. Tuning the formula today never falsifies what a score meant last month; every change is also recorded in the audit log.