Insights · VAPT · Point of view

Risk-Based Vulnerability Management: prioritising by exploitability, not just CVSS.

SECURISTI TECHNICAL SECURITY PRACTICE · 5 MIN READ

Most teams still triage vulnerabilities by CVSS score alone. It's the wrong lens. A 9.8-rated flaw sitting on an isolated, non-internet-facing box is lower risk than a 6.5 on an internet-facing system with active exploit code in the wild. Risk-Based Vulnerability Management (RBVM) fixes the ranking, not the scanning.

Why CVSS alone breaks down

CVSS scores severity in a vacuum, how bad the flaw is if exploited, not the likelihood it will be. It ignores exposure (is the asset internet-facing?), exploit maturity (is there a public exploit or active campaign?), and business context (what does this asset actually run?). Teams that patch strictly by CVSS score end up burning cycles on unreachable, low-value findings while real exposure sits open.

What a risk-based model adds

RBVM layers three additional signals on top of severity: asset criticality (what the system does and what data it touches), exploitability (active exploitation, exploit kits, weaponised PoCs), and exposure (network reachability, compensating controls already in place). The result is a single prioritised queue, not a severity list, ranked by actual risk to the business.

Making it operational

The shift is procedural as much as technical. Remediation SLAs get tied to the risk score, not the raw CVSS, so a critical-CVSS finding on a hardened, segmented asset can wait behind a moderate-CVSS finding under active exploitation on an exposed system. Ownership and ageing get tracked per asset, feeding the same continuous evidence loop that a CCAP-style programme already runs on.

Where this fits: RBVM runs as part of our Technical Security practice and feeds directly into CCAP control evidence. Talk to us about prioritising your current backlog.

This article is informational and reflects Securisti's practice experience as at July 2026.