Vulnerability Prioritizer
A scanner hands you hundreds of findings sorted by CVSS — but CVSS is severity, not risk. Add each finding's real-world context — is it on CISA KEV, does a public exploit exist, is the asset internet-facing or business-critical, is there a compensating control — and this tool turns severity into a transparent priority score, a ranked remediation order and a clear action bucket. Everything runs in your browser.
How the score is built (fully transparent)
CVSS is severity, not risk. The base CVSS contributes up to 40 points (cvss/10 × 40). Risk factors add on top: KEV +25, public exploit / EPSS-high +12, internet-facing +13, business-critical +10, and a compensating control subtracts −18. The total is clamped 0–100 and bucketed: ≥70 Act now, ≥45 This sprint, ≥20 Backlog, else Accept. CISA KEV and EPSS are referenced as concepts — set the toggles yourself; nothing is fetched.
What this tool is
- A free, in-browser vulnerability prioritizer: add findings with a CVSS base score and real-world context toggles (KEV, public exploit/EPSS-high, internet-facing, business-critical, compensating control) and get a transparent 0-100 priority score, ranked order and a bucket.
- CVSS measures severity, not risk. A 9.8 on an internal, well-mitigated box can matter less than a 7.5 that is internet-facing and on CISA KEV. The model turns severity into risk by layering context on top.
- Buckets map to action: Act now (≥70), This sprint (≥45), Backlog (≥20) and Accept (below 20) — so a long scanner list becomes a short do-first queue.
- CISA KEV (known-exploited) and EPSS (exploit-likelihood) are referenced as concepts you toggle — there is no live API, no network call and nothing leaves your browser.
- Load the sample dataset to see the model in action, then copy or export the ranked list for your ticketing system.
Why this matters
Most vulnerability backlogs are impossible to clear and dangerous to work top-down by CVSS. A thousand "High" findings all look equally urgent, so teams either burn out patching low-impact issues or freeze. Risk-based prioritization fixes this by asking a different question: not how severe is this flaw, but how likely is it to be exploited here, and how much would it cost us. A medium-severity CVE that is actively exploited (on CISA KEV), internet-facing and sitting on a payment system outranks a critical-severity flaw buried on an internal host behind strong segmentation.
The model here is deliberately simple and fully visible so you can defend every ranking in a review: CVSS sets a severity floor, exploitation and exposure signals push findings up, and a genuine compensating control pulls them down. The output is a short do-first queue instead of an undifferentiated wall of red — which is the entire point of an ASPM / vulnerability-management program.
Frequently asked questions
How should I prioritize vulnerabilities — is CVSS enough?
CVSS alone is not enough. CVSS is a severity score: it describes how bad a flaw is in the abstract, not how likely it is to hurt you. Risk-based vulnerability management combines severity with real-world context — is the vulnerability being actively exploited (CISA KEV), does a public exploit exist or is EPSS high, is the affected asset internet-facing, is it business-critical, and is there a compensating control in place? This tool makes that layering explicit: CVSS sets a severity floor and the context toggles move the finding up or down into an action bucket.
What are CISA KEV and EPSS?
CISA KEV (Known Exploited Vulnerabilities) is a catalog, maintained by the US Cybersecurity and Infrastructure Security Agency, of vulnerabilities that are confirmed to be exploited in the wild — being on it is one of the strongest signals to patch urgently. EPSS (Exploit Prediction Scoring System, from FIRST.org) estimates the probability that a vulnerability will be exploited in the next 30 days. This tool references both as concepts you toggle on a finding; it does not call any API or fetch any live data. You set the KEV and exploit flags from whatever source you trust.
How is the priority score calculated?
It is a transparent additive model you can audit. The CVSS base (0-10) contributes up to 40 points (cvss ÷ 10 × 40). Then risk factors add on top: on CISA KEV +25, public exploit / EPSS-high +12, internet-facing asset +13, business-critical asset +10; a compensating control subtracts 18. The total is clamped to 0-100 and bucketed: 70+ is Act now, 45+ This sprint, 20+ Backlog, below 20 Accept. Nothing is hidden — the weights are printed under the ranked list and the math runs in your browser.
Is this a scanner or does it connect to my environment?
No. It is a 100% client-side planning aid — a defensive, educational helper for security teams. It performs no scanning, makes no network calls, stores no secrets and reads nothing from your environment. You paste or add findings and toggle their context by hand; the scoring and ranking happen locally in the browser. Export the ranked list to feed your own ticketing or vulnerability-management workflow.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.Educational — general guidance, not security advice.