The bgx Lens

After spending the last decade managing vulnerabilities across Fortune 500 companies, I’ve witnessed firsthand the critical importance of proper prioritization. Despite the clear need, there are no free tools offering the necessary flexibility, and even commercial solutions fall short of addressing this challenge comprehensively. This is why I developed CVE Risk Compass.

The Vulnerability Prioritization Challenge

In today’s complex cybersecurity landscape, organizations face an overwhelming number of vulnerabilities. Security teams struggle to determine which issues demand immediate attention and which can wait. Without a structured approach, vital resources are often misallocated, leaving critical vulnerabilities unaddressed while teams focus on less impactful issues.

Most organizations still rely heavily on CVSS scores alone, which only tell part of the story. This one-dimensional approach neglects crucial factors like exploitation likelihood and business impact. The result? Security teams drowning in “critical” vulnerabilities without clear guidance on which truly deserve immediate attention.

Introducing CVE Risk Compass

CVE Risk Compass is an open-source project that offers a solution to this challenge — a comprehensive vulnerability prioritization framework that integrates business context and multiple industry standard metrics (CVSS, EPSS, KEV, SSVC) with flexibility at its core. This data-driven approach helps security teams focus on what matters most by considering three essential dimensions:

Technical severity (How bad is it?)
Exploitation likelihood (How likely is it to be exploited?)
Organizational impact (what’s the potential damage to your business?)

Your Process Should Define Your Tools, Not Vice Versa

A fundamental principle behind CVE Risk Compass is that security tools should adapt to your organization’s established processes—not force you to change how you operate. Unlike traditional vulnerability management solutions that require teams to adapt to rigid methodologies and their “secret sauce” under the hood, CVE Risk Compass is designed with unparalleled flexibility, allowing it to conform to your unique security needs and risk tolerance profile.

This philosophy recognizes that each organization has specific security requirements based on its industry, size, compliance requirements, and threat landscape. By providing a framework that adapts to your processes rather than dictating them, CVE Risk Compass empowers security teams to implement consistent vulnerability prioritization that aligns with their existing workflows.

A critical insight built into the framework is the understanding that the same vulnerability can and should receive different prioritization based on the business impact of the affected asset. For example, a CVE affecting a High Business Impact (HBI) system will be assigned a much higher remediation priority than the identical vulnerability affecting a Low Business Impact (LBI) system. This business-context awareness ensures that your remediation efforts align with actual risk to your organization, not just technical severity metrics.

How CVE Risk Compass Works: A Multi-Stage Approach

Stage 1: Data Enrichment

The framework begins by gathering and normalizing data from authoritative sources:

NVD: CVSS scoring and technical vulnerability details
EPSS: Statistical exploitation probability metrics
CISA KEV: Known exploited vulnerabilities tracking
CISA SSVC: Stakeholder-specific vulnerability categorization

Stage 2: Severity Assessment

Next, the framework evaluates technical severity by:

Selecting the most appropriate CVSS version based on predefined priority (by default prioritizing v4.0 over v3.1, v3.0, and v2)
Classifying vulnerabilities into severity levels (CRITICAL, HIGH, MEDIUM, LOW, NONE) based on pre-defined thresholds.

Stage 3: Exploit Risk Assessment

This critical step evaluates exploitation likelihood through:

Checking if the vulnerability appears on CISA’s Known Exploited Vulnerabilities list
Evaluating the EPSS score to determine exploitation probability
Assigning an exploit risk level (IMMINENT, ELEVATED, NOTABLE, NEGLIGIBLE, UNKNOWN) based on pre-defined thresholds.

Stage 4: Impact Assessment

The framework then evaluates organizational impact for High, Medium and Low importance assets simultaneously, using the SSVC decision model and considering:

Exploitation status (Active, PoC, None, Unknown)
Automation potential (Yes, Partial, No, Unknown)
Technical impact (Total, Partial, Limited, Unknown)
Business impact (High, Medium, Low)

Stage 5: Remediation Prioritization

Finally, all assessment factors combine to determine a clear priority level based on customizable decision tree for each Business Impact level simultaneously:

P0: Immediate - Critical vulnerabilities requiring remediation within 24 hours
P1: Urgent - High-priority vulnerabilities to address within 48 hours to 1 week
P2: Important - Medium-priority vulnerabilities to handle within 1-2 weeks
P3: Scheduled - Lower-priority vulnerabilities for regular maintenance (2-4 weeks)
P4: Monitor - Lowest-priority vulnerabilities that can be monitored without immediate action

For more details, refer to this workflow.

Implementation Challenges and Solutions

While implementing any new framework presents challenges, CVE Risk Compass is designed to minimize disruption:

Asset priority: Start with a simplified three-tier model (HBI, MBI, LBI) based on organizational and business importance, and refine over time.
CVE Priority consistency across tools: Leverage the scanner-agnostic design to implement a consistent knowledge base across your entire security stack.
Stakeholder buy-in: Use the transparent, data-driven approach to clearly justify prioritization decisions when communicating with leadership.

Why Your Security Team Needs This Framework

Traditional vulnerability management approaches leave security teams overwhelmed and often misdirected. CVE Risk Compass provides critical advantages that transform how organizations handle vulnerabilities:

Multi-Dimensional Risk Assessment – Goes beyond one-dimensional CVSS scores to incorporate exploitation likelihood and business impact, resulting in truly risk-based prioritization
Business Context Integration – Differentiates remediation priorities based on asset importance (HBI/MBI/LBI), ensuring the same vulnerability receives appropriate attention based on the affected system’s business value
Data-Driven Decision Making – Reduce subjectivity by leveraging authoritative intelligence sources (NVD, EPSS, CISA KEV, SSVC) to inform prioritization decisions
Consistent Cross-Tool Prioritization – Eliminates inconsistent vulnerability ratings across different security tools by applying a unified knowledge base across your entire security stack (i.e. Qualys, Tenable, Blackduck, Checkmarx, Prisma, etc.)
Resource Optimization – Dramatically reduces the number of “critical” vulnerabilities requiring immediate attention, allowing teams to focus limited resources on genuine threats
Defensible Governance – Provides transparent, data-backed justification for remediation priorities that satisfies auditors, leadership, and compliance requirements
Zero-Code Customization – Adapts decision tree outcomes to your organization’s unique risk tolerance profile without requiring code modifications, enabling rapid implementation and adjustment

Conclusion: Transform Your Vulnerability Management

CVE Risk Compass represents a significant step forward in vulnerability management strategy. By moving beyond simplistic CVSS-based prioritization to a comprehensive, multi-dimensional approach, security teams can focus their efforts where they matter most.

The framework’s adaptable nature means it can evolve with your organization’s changing risk profile and maturity level while maintaining consistency across your security toolset. For security leaders looking to optimize their vulnerability management program, CVE Risk Compass offers a powerful solution backed by industry-standard data sources and proven methodologies.

Explore CVE Risk Compass on GitHub and start focusing on the vulnerabilities that truly matter to your business.