Risk is composite.
CVSS is only one input.
A full vulnerability sweep against the production tenant. The agent scored every open vuln across four weighted dimensions: exploit intelligence, asset criticality, exposure, and compensating controls. The output is a prioritized list ranked by composite risk, not CVSS. The top finding is a CVSS 9.8 OpenSSL pre-auth RCE. The second-ranked finding has no public CVE record at all, on a server actively handling Confidential and Private data.
Vulnerability prioritization is not alert triage. Different cadence, different data, different downstream owners. Same agent. Same artifact discipline. Same audit trail.
Asset criticality came from DLP telemetry. Compensating controls came from inventory + network. The risk model needs all four dimensions, and they live in four different connectors.
DLP telemetry showed what data actually moved through each host. That’s what changed the ranking. Policy documents lag reality.
The wrong question is “how bad is the CVE?”
CVSS scores the vulnerability in isolation. A CVSS 9.8 on a server in a locked-down DMZ with no sensitive data is not the same risk as a CVSS 6.0 on a host actively handling Confidential files. The agent inverts the question: what risk does this vulnerability pose to this organization, right now, on this asset?
Four dimensions, each scored on a 1–5 scale, combined into a composite risk score with SSVC-style action assignment (Track / Track* / Attend / Act):
1 · Exploitability
EPSS score, CISA KEV listing, public PoC documentation, automatability, attack complexity. CVSS is one input among many.
2 · Asset Criticality
What does this host do? DLP telemetry, data classification on disk, role inferred from hostname + traffic patterns. Tier 1 / 2 / 3 / unknown.
3 · Exposure
Internet-facing or internal? Segmentation evidence? Live network activity confirming reachability? RFC 1918 vs public.
4 · Compensating Controls
EDR present? Firewall enforcement? Stack canaries / ASLR? Each control reduces effective risk for a known attack class.
Composite risk ranks four hosts ahead of 1,200 higher-CVSS findings.
device.hostname. Resolve via
connector 1169 to escalate per Tier 1 finding.
nicole.w*** accessed
Confidential files on VIRTSRV-799 today (2026-04-02). A server actively handling Confidential and
Private data is likely Tier 1 or 2 regardless of the CVE itself. Low exploit intel (no public CVE
record, no EPSS score) keeps the composite score in Medium, but asset
criticality alone elevates this above nearly every other open finding.
CVSS is an input. Risk is the output.
The top CVSS in this case is OpenSSL CVE-2025-15467 at 9.8. The number-two ranked finding has no public CVE record at all. Rank order changed because asset criticality changed. CVSS-only prioritization buries the host actively handling Confidential data.
Asset criticality comes from telemetry, not policy.
The agent didn’t read an asset-tier policy document. It queried DLP for what data actually moves through each host. nicole.w*** accessing Confidential files on VIRTSRV-799 today is the evidence. Policy documents lag reality. The mesh sees what’s happening now.
Dwell time is a hygiene score, not a vuln score.
CVE-2022-2757 has been on VIRTSRV-799 for 4 years. The vulnerability hasn’t changed. The fact that nobody patched it in that time is a separate, organizational finding. The agent surfaces both.
SSVC beats numeric scores when the answer is “what action.”
The output is not a 1,247-row spreadsheet sorted by score. It’s a Track / Track* / Attend / Act assignment per finding. Action is the right unit of vulnerability response. Risk score is just the input.
Key queries: collect, enrich, rank
Q1Open vulnerabilities: full sweepINTAKE
Q4Exploit intel enrichment: EPSS + CISA KEVENRICH
Q7DLP cross-reference: what data does each host actually handle?ASSET CRIT
Q9Exposure: RFC1918 vs public, segmentation evidenceEXPOSURE
Q11Compensating controls: EDR + stack mitigations per hostCONTROLS
Showing 5 of 14 queries. Full audit trail across queries.md, findings-raw.md, enrichment.md, prioritized-list.md, remediation-groups.md.
Sources queried · with status
| Source | Status | Notes |
|---|---|---|
| vuln.atb_mde (1169) | HIT | Hostnames populated; primary connector for Rank 2/3 attribution |
| vuln.atb_mde (360) | HOSTNAMES MISSING | device.hostname unpopulated; top finding affected; resolve via 1169 |
| intel.epss | HIT | 50 of 50 top CVEs enriched |
| intel.cisa_kev | HIT | 3 of 50 top CVEs match KEV |
| dlp_activity | HIT | Asset criticality signal: Confidential / Private classification on VIRTSRV-799 |
| inventory_info (mitigations) | PARTIAL | OS / patch level on most hosts; stack mitigation detail incomplete |
| network_activity | HIT | Segmentation evidence via policy-deny events |
Coverage gaps · with priority
- HIGH: Connector 360 doesn’t populate
device.hostnameon 7 hosts affected by the top-ranked OpenSSL finding. Asset tier cannot be resolved without cross-querying connector 1169. - MEDIUM: Stack mitigation detail (canaries, ASLR, CET) missing on 3 hosts. Compensating-controls scoring falls back to defaults where evidence is absent.
- MEDIUM: CVE-2024-6164 and CVE-2026-5290 have no public CVE record or EPSS score. Validate with scanner vendor before finalizing remediation priority.
- LOW: Internet-exposure check assumes RFC 1918 = internal. Hosts behind reverse proxies / load balancers may be effectively internet-facing despite private IP.
Rank your vuln backlog by actual risk.
Bring your scanner exports.