Vulnerability Prioritization
A focused sequence on the specific question of what to fix first — the standards involved, why severity alone is an incomplete answer, and a tool to apply the reasoning to a real finding.
- Audience
- Engineers or managers with an existing backlog of findings who need a defensible way to decide what gets fixed first.
- Level
- Intermediate
- Depth
- Short — seven steps, entirely reference material and one interactive tool.
Prerequisites
- None, though Application Security Foundations introduces the same core idea more gradually.
Learning Objectives
- Understand what CVSS, EPSS, and CISA KEV each measure, and why none of them alone is sufficient.
- Recognize the CWE-level weakness behind a finding, independent of which framework's numbering reported it.
- Produce a suggested priority for a real finding using all of the above together.
0 of 7 complete (0%)
Progress is saved only in this browser.
Steps
1. Vulnerability Management
OpenCategory
The category overview — turning raw findings into a prioritized, trackable backlog.
2. Vulnerability Prioritization Beyond CVSS
OpenArticle
The core argument this entire path is built around: severity alone doesn't determine what to fix first.
3. CVSS Reference
OpenReference Collection
The severity input — what it measures, and what it deliberately leaves out (exploitation likelihood, business context).
4. EPSS Reference
OpenReference Collection
The exploitation-likelihood input CVSS was never designed to provide.
5. CISA Known Exploited Vulnerabilities
OpenReference Collection
Confirmed active exploitation — the strongest override signal available, independent of either score above.
6. CWE-922: Insecure Storage of Sensitive Information
OpenReference
A concrete example of a weakness whose real-world priority depends heavily on context CVSS alone can't capture.
7. Vulnerability Prioritization Matrix
OpenDecision Center
Apply all of the above together against a specific finding, not just in the abstract.
Related Learning Paths
Application Security Foundations
The starting sequence for engineers who are new to application security at Strata — what gets measured, against which standards, and where the platform's own reasoning about priority comes from.
Engineering Manager AppSec
For managers, directors, and CTOs who need to report on application security risk and prioritize a backlog without necessarily writing the fixes themselves.