Cyber Risk Prioritization Model (Research)

Summary

The problem is volume. Published data show remediation falling behind. Verizon found 26 percent of critical CISA Known Exploited Vulnerabilities fully remediated, down from 38 percent.
Severity scores are a weak sort key. About 6 percent of published vulnerabilities have ever been seen exploited. Prioritizing by exploitation likelihood delivers more risk coverage for far less effort than prioritizing by severity score alone.
Vulnerabilities are only one route in. Exploitation leads breach entry at 31 percent, but credential abuse, third parties and human factors account for large shares of the rest.
The model proposed here scores three things: reachability, evidence of exploitation and business impact. It gives no credit for controls that have not been tested.
Status of the findings. The data below are published by others. The model is Cybrilliant’s own analytical construct. Its weights have not been calibrated against a client dataset, and confidence in it is low until they are.

The question

How should an organization decide which cyber risks to treat first when it has more findings than capacity to fix them? Most programs answer with a severity-sorted list. This report tests whether published evidence supports a better sort, and proposes one.

Method and evidence base

We did not run a primary survey. We used four published datasets, each chosen because it is built from observed events rather than opinion. Their scope and limits are stated so that readers can judge how far to trust each one.

Dataset	Sample and method	Used for	Limits
Verizon Data Breach Investigations Report (latest edition)	More than 31,000 incidents and more than 22,000 confirmed breaches across 145 countries, from almost 100 contributors. Normalized with VERIS. Uncertainty shown with 95 percent confidence intervals.	Initial access, third-party and human-element shares; KEV remediation	Regional visibility depends on disclosure laws and contributor locations. Overlapping intervals mean some year-on-year changes might not be meaningful.
Mandiant M-Trends (latest edition)	Mandiant Consulting investigations of targeted attacks across one calendar year, backed by more than 500,000 hours of incident response.	Initial infection vectors; time to exploit; detection source	Reflects organizations that engaged an incident responder. Vector shares cover investigations where a vector was identified.
Cyentia and FIRST research on EPSS	237,687 published CVEs and more than 8.6 million observations of daily exploitation activity from a global contributor network.	Share of vulnerabilities exploited; value of exploitation-based ranking	Covers CVEs only. Exploitation without a CVE is outside its scope, a limit Verizon also notes.
CISA Known Exploited Vulnerabilities catalog	Vulnerabilities CISA has evidence of being exploited in the wild.	Defining “exploitation observed” in the model	A catalog entry is evidence of exploitation somewhere. It does not mean your instance is exposed.

What the published data show

Finding 1: severity is not likelihood

The Cyentia analysis finds about 6 percent of published vulnerabilities have ever been observed exploited. Half of the known-exploited vulnerabilities are never seen in more than 0.02 percent of organizations. The same research reports that an exploitation-based strategy reaches 93 percent risk coverage at a fixed level of effort, against 37 percent for fixing CVSS 9 and above. Put plainly, a team that fixes the highest severity scores first is mostly working on vulnerabilities attackers are not using.

Finding 2: the backlog is growing where it matters

Verizon reports only 26 percent of critical KEV vulnerabilities were fully remediated, down from 38 percent, and median time to full remediation rose to 43 days from 32. Mandiant estimates mean time to exploit at minus seven days. The time available to remediate is shrinking while the time taken is lengthening.

Finding 3: vulnerabilities are not the whole picture

Exploitation is now the leading entry route at 31 percent of breaches, ahead of credential abuse at 13 percent. The human element appears in 62 percent of breaches and third parties in 48 percent. Mandiant finds exploits at 32 percent of identified vectors, voice phishing at 11 percent, and prior compromise as the top vector in ransomware cases at 30 percent. A vulnerability list leaves out the majority of what breaks organizations.

Finding 4: third-party exposure is slow to close

Only 23 percent of third-party organizations had fully remediated cloud MFA gaps, and half of the findings for weak passwords and permission misconfigurations took almost eight months to resolve. These are exposures with no CVE and no scanner score.

The model

Every exposure is scored from 1 to 5 on three factors. An exposure is any condition an attacker could use: a vulnerability, a missing control, an over-privileged identity, a vendor connection.

Score	Reachability	Evidence of exploitation	Business impact
1	Internal only, behind several independent barriers	Theoretical; no known abuse	Negligible; no critical process or data affected
2	Internal, reachable after one barrier is breached	Proof of concept exists	Local disruption; recoverable within normal operations
3	Reachable by any authenticated user or integration	High exploitation probability (for example a high EPSS score) or technique widely discussed	Material disruption or regulated data of limited volume
4	Reachable through a third party, an identity path or a remote service	Pattern documented in published incident data for this exposure type	Disrupts a critical service, or exposes sensitive data at scale
5	Directly internet-facing, or reachable with one stolen credential	Listed in the KEV catalog, or active campaign against it	Touches a crown jewel; major operational, financial or regulatory consequence

Scoring rule

Priority = Reachability × Evidence × Impact (range 1 to 125).

Controls earn credit only when tested. A control that has been exercised in a test, exercise or real incident can lower the reachability score. A control that is assumed or documented does not. This is the main departure from conventional registers, and it is deliberate: assumed controls are the commonest source of overstated assurance.

Tier	Score	Meaning
Tier 1	60 or above	Treat now. Executive visibility and an owner with authority to change systems.
Tier 2	27 to 59	Plan and fund. Treat within the normal planning cycle.
Tier 3	Below 27	Monitor. Accept, defer or fix opportunistically.

The tier thresholds are starting values chosen for separation, not calibrated figures. They should be adjusted against an organization’s own incidents and test results.

Illustrative example

The four items below are hypothetical and are not client data. They show how the model behaves.

Exposure	R	E	I	Score	Tier
Internet-facing remote access appliance with a KEV-listed flaw, protecting access to the finance network	5	5	4	100	Tier 1
Vendor administrator account on a cloud tenant without MFA, with access to a customer data store	4	4	5	80	Tier 1
Connected application holding broad OAuth scope into the CRM	4	4	3	48	Tier 2
Internal print server with a CVSS 9.8 flaw and no known exploitation	2	2	2	8	Tier 3

A severity-sorted list would put the print server first. The model puts the appliance and the vendor account first, and the vendor account has no CVE at all. That difference is the reason to build the model.

What the data support, and what they do not

Supported by published data	Not supported
Exploitation evidence is a better ranking input than severity alone.	That the specific 1 to 5 weights are correct. They are untested.
Third parties, identities and human factors are major routes into breaches.	That impact can be scored from data. It needs business input from asset owners.
Remediation is slower than exploitation for many organizations.	That tier boundaries transfer between sectors or sizes.
Exposures without a CVE are common enough to need a place in the register.	That a high score predicts a breach. It ranks treatment order and does not forecast loss.

Limitations

Selection bias. Breach and incident-response datasets describe organizations that were breached or called for help. They do not show the full population of exposures that were never exploited.
CVE anchoring. Exploitation scoring models cover published vulnerabilities. For exposures outside that scope, the evidence score depends on documented patterns and judgment.
Subjective impact. Impact scoring is only as good as the crown jewel list and the people who contribute to it.
No calibration. We have not tested the model against an organization’s historical incidents. Until that is done, treat the output as a structured judgment, not a measurement.
Moving evidence. Exploitation status changes. A register scored once and left alone will go stale within weeks.

Using the model

Start with the crown jewels. Without an agreed list of the systems and data whose loss would hurt most, impact scores are guesses.
Put non-CVE exposures in the same register. Vendor access, identity gaps and integration scopes compete with vulnerabilities for the same capacity.
Rescore on events. Add a new KEV listing, a new incident in the sector or a change in architecture as triggers for review.
Test before you credit. Choose the five highest scoring exposures and test the controls claimed against them. Let the results change the scores.
Report tiers, not counts. Show leadership how many Tier 1 exposures exist, how old they are and what has moved. Raw vulnerability totals say little about risk.
Calibrate. After two review cycles, compare Tier 1 and Tier 3 items against actual incidents, near misses and test results, and adjust weights.

Claim discipline: statistics are reported as published. The scoring model, tiers and recommendations are analysis and opinion, not research findings.

Sources

Verizon, Data Breach Investigations Report, latest edition, including executive summary and methodology notes. verizon.com
Google Cloud / Mandiant, M-Trends, latest edition. cloud.google.com
Cyentia Institute and FIRST, research on the Exploit Prediction Scoring System (EPSS), “A Visual Exploration of Exploitation in the Wild”. cyentia.com
Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog. cisa.gov
NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments (likelihood and impact as the basis of risk assessment). csrc.nist.gov

Research: The Enterprise Cyber Risk Prioritization Model