From vulnerabilities to priorities: designing a context-based RBVM approach
An RBVM approach connecting data quality, asset criticality, exposure, severity, threat, controls, remediation constraints, ownership, and residual risk.
Exposure
Having 10,000 vulnerabilities does not mean having 10,000 priorities
Vulnerability management creates value when it turns thousands of findings into a manageable number of decisions that can be executed, validated, and explained.
What information is missing when a vulnerability only has a CVSS score
A CVSS score can tell us a great deal about a vulnerability and very little about what an organization should do first.