Overwhelmed by Alerts? A Guide to Risk-Based Prioritization Over CVS

Adopt a Risk-Based Prioritization Model Beyond CVSS

Executive Summary

Last week, we continued our series on 10 Best Cloud Practices for the Modern Enterprise.

Risk-Based Vulnerability Management

---

The sheer volume of new vulnerabilities disclosed daily is overwhelming for even the most well-resourced security teams.³⁵ Research has shown that organizations, on average, are only able to remediate 10-15% of their open vulnerabilities each month.³⁶ Simultaneously, over half of all known vulnerabilities carry a Common Vulnerability Scoring System (CVSS) score of "High" or "Critical" (7.0 or above).³⁷ This mathematical reality makes a "patch everything" approach not only impractical but also strategically flawed. Attempting to address all high-severity vulnerabilities leads to a constant state of reactive firefighting, wastes valuable resources on threats that pose little actual danger, and causes "patch fatigue" among IT and security teams.

The only sustainable and effective strategy is to adopt a risk-based prioritization model.³⁸ This approach moves beyond the single data point of a CVSS score to incorporate a rich set of contextual factors, allowing teams to focus their finite time and resources on the small subset of vulnerabilities that represent a genuine and immediate threat to the business. This fundamentally changes the goal of a vulnerability management program from an activity-based metric ("how many vulnerabilities did we patch?") to an outcome-based one ("how much risk did we reduce?"). This shift is critical for communicating the value of the security program to business leaders and for making meaningful progress in strengthening the organization's security posture.

The Limitations of CVSS

The CVSS is an open industry standard for assessing the technical severity of vulnerabilities. It provides a valuable, standardized starting point, but it was never intended to be a comprehensive measure of risk.³⁹ Its primary limitation is a lack of context. A CVSS score is calculated based on the intrinsic characteristics of a vulnerability (e.g., attack vector, complexity) but does not account for crucial environmental and temporal factors, such as ³⁶:

• Active Exploitation: Is the vulnerability being used by attackers in the wild?

• Asset Criticality: Is the affected asset a mission-critical production server or a non-essential development machine?

• Exposure: Is the asset internet-facing or isolated on an internal network?

• Compensating Controls: Are there other security measures in place (like a WAF or strict access controls) that mitigate the risk?

Relying solely on CVSS for prioritization creates a significant amount of noise and can lead teams to spend time on high-severity, low-risk issues while ignoring lower-severity vulnerabilities that are actively being exploited.

The Pillars of Modern Risk-Based Prioritization

An effective risk-based model synthesizes multiple data streams to create a holistic view of risk. The most critical factors to consider include ³⁸:

1. Threat Intelligence and Exploitability: This is arguably the most important factor beyond CVSS. Evidence that a vulnerability is being actively exploited is the strongest possible indicator of immediate risk.³⁶ This involves integrating real-time threat intelligence feeds, such as CISA's Known Exploited Vulnerabilities (KEV) catalog, which lists vulnerabilities that federal agencies are required to patch due to active exploitation.³⁵ Furthermore, predictive models like the Exploit Prediction Scoring System (EPSS) provide a probability score (from 0% to 100%) indicating the likelihood that a vulnerability will be exploited in the next 30 days, offering a powerful forward-looking perspective.³⁶

2. Asset Criticality and Business Context: The business impact of a compromise is directly tied to the importance of the affected asset.⁸ A mature program must be able to assign a criticality rating to each asset based on its function, the data it handles, and its importance to revenue-generating activities.⁴⁴ A medium-severity vulnerability on a "crown jewel" asset, such as a database containing sensitive customer PII, should be prioritized far above a critical vulnerability on a temporary test server.⁸

3. Exposure and Attack Path Analysis: The context of a vulnerability within the network architecture is paramount. A vulnerability on an internet-facing system is inherently more exposed than one on a deeply segmented internal network.³⁷ Modern security platforms take this a step further with
   attack path analysis, which models how an attacker could chain together multiple vulnerabilities, misconfigurations, and excessive permissions to move laterally through the network and reach a high-value asset.⁹ Prioritizing vulnerabilities that act as "choke points" or key links in these attack chains is an incredibly effective way to disrupt attackers and reduce risk.

Microsoft Implementation

The Microsoft security suite is built from the ground up to support a sophisticated, risk-based prioritization model.

Microsoft Defender Vulnerability Management

This solution moves far beyond traditional CVSS-based scanning. It inherently uses a risk-based prioritization engine that enriches its findings with a wealth of contextual data.²⁰ The platform correlates discovered vulnerabilities with:

• Microsoft's Threat Intelligence: Drawing from trillions of daily signals, Defender identifies which vulnerabilities are associated with active exploits, malware campaigns, or emerging threats.²¹

• Breach Likelihood Predictions: It uses machine learning to predict the likelihood of a breach based on the vulnerability and the device's posture.

• Business Context: It identifies and prioritizes vulnerabilities on assets that are deemed business-critical, either through automated discovery or manual tagging.²¹
  
  This allows Defender Vulnerability Management to surface a single, prioritized list of security recommendations focused on the threats that pose the highest risk to the organization.

Microsoft Defender for Cloud - Attack Path Analysis

This is one of the most powerful capabilities for contextual risk prioritization available today. Attack path analysis, a key feature of Defender CSPM, provides a visual, graph-based map of potential attack routes within the cloud environment.³ It doesn't just show a list of isolated vulnerabilities; it shows how an attacker could, for example:

1. Exploit a public-facing web application vulnerability.

2. Use the compromised identity of the web application to access a key vault.

3. Retrieve credentials from the key vault.

4. Use those credentials to access a production database containing sensitive data.

By visualizing this entire chain, Defender for Cloud allows security teams to prioritize the remediation of the specific vulnerability or misconfiguration that would break the attack chain, providing the ultimate form of risk-based prioritization.⁹

This approach transforms the conversation with business leaders. Instead of reporting on abstract technical metrics, a CISO can present a clear, data-driven narrative about business impact. For instance, a report can shift from stating, "We patched 5,000 vulnerabilities this month," to, "We eliminated the 10 most likely attack paths to our customer database by remediating 50 critical exposures." This language of risk reduction is far more meaningful and aligns security efforts directly with business objectives, a core principle of frameworks like the NIST Risk Management Framework (RMF).¹⁶

---

Some security tools you can consider for improving your business security posture:

Crowdstrike endpoint protection https://crowdstrike2001.partnerlinks.io/Cpf-coaching

INE Security Awareness and Training https://get.ine.com/snyc9gtnuhbb

Tenable vulnerabilities management https://shop.tenable.com/pmscn6dtufjc-vqqg32

Cyvatar.AI Managed endpoint protection solution for SMBs https://cyvataraif5706.referralrock.com/l/CHRISTOPHE77/

Omnistruct helping you with your privacy, GRC and security programs https://omnistruct.com/partners/influencers-meet-omnistruct/

Guidde help you turn your tribal and undocumented processes into easy documented videos and instructions https://affiliate.guidde.com/cpf-coaching

---

Works cited

1. Vulnerability Management Lifecycle: An Easy Guide - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/vulnerability-management-lifecycle/

2. What is the vulnerability management lifecycle? - Red Canary, accessed June 26, 2025, https://redcanary.com/cybersecurity-101/security-operations/vulnerability-management-lifecycle/

3. Microsoft Defender for Cloud - CSPM & CWPP | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/defender-for-cloud

4. Microsoft Defender for Cloud Overview, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

5. Start planning multicloud protection in Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-multicloud-security-get-started

6. Vulnerability Management Lifecycle: 6 Steps - Swimlane, accessed June 26, 2025, https://swimlane.com/blog/vulnerability-management-lifecycle/

7. The Vulnerability Management Lifecycle Explained (5 Steps) - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-lifecycle/

8. The Vulnerability Management Lifecycle in 6 Stages | Wiz, accessed June 26, 2025, https://www.wiz.io/academy/vulnerability-management-lifecycle

9. Vulnerability Management: Components, Lifecycle & Best Practices ..., accessed June 26, 2025, https://www.exabeam.com/explainers/information-security/vulnerability-management-components-lifecycle-and-best-practices/

10. Vulnerability Management Framework - Balbix, accessed June 26, 2025, https://www.balbix.com/insights/vulnerability-management-framework/

11. Vulnerability Management Lifecycle: Key Steps for Security - Akto, accessed June 26, 2025, https://www.akto.io/learn/vulnerability-management-lifecycle

12. Why Every Vulnerability Management Strategy Starts with Asset Management - SIRP, accessed June 26, 2025, https://sirp.io/blog/why-every-vulnerability-management-strategy-starts-with-asset-management/

13. Cloud Vulnerability Management [Best Practices 2025] - Sentra, accessed June 26, 2025, https://www.sentra.io/learn/cloud-vulnerability-management

14. Azure Vulnerability Management Guide for 2025 - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/azure-vulnerability-management/

15. Vulnerability Management Lifecycle: A Comprehensive Guide - Escape.tech, accessed June 26, 2025, https://escape.tech/blog/vulnerability-management-lifecycle/

16. NIST Vulnerability Management: Defintion and Implementaion, accessed June 26, 2025, https://cynomi.com/nist/nist-vulnerability-management/

17. NIST CSF 2.0: A Framework for Vulnerability Management - SecurityBridge, accessed June 26, 2025, https://securitybridge.com/blog/nist-csf-2-0-for-vulnerability-management/

18. The NIST Cybersecurity Framework (CSF) 2.0 - NIST Technical ..., accessed June 26, 2025, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

19. Cloud Security Posture Management (CSPM) - Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management

20. Microsoft Defender Vulnerability Management | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/threat-protection/microsoft-defender-vulnerability-management

21. Microsoft Defender Vulnerability Management, accessed June 26, 2025, https://learn.microsoft.com/en-us/defender-vulnerability-management/defender-vulnerability-management

22. Azure Security Control - Vulnerability Management | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/security/benchmark/azure/security-control-vulnerability-management

23. Vulnerability Management Best Practices - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-best-practices/

24. Overview - Data security posture management - Microsoft Defender for Cloud, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-data-security-posture

25. PowerBI Dashboard - SQL Queries - Rapid7 Discuss, accessed June 26, 2025, https://discuss.rapid7.com/t/powerbi-dashboard/41520

26. Microsoft Defender for Cloud - CSPM & CWPP | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/defender-for-cloud/

27. Connect your AWS account - Microsoft Defender for Cloud ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws

28. Steps to Integrate Microsoft Defender for Cloud with AWS Account — Enable Defender for Servers | by Poojashetty | KPMG UK Engineering | Medium, accessed June 26, 2025, https://medium.com/kpmg-uk-engineering/steps-to-integrate-microsoft-defender-for-cloud-with-aws-account-enable-defender-for-servers-b2110d6be0f6

29. Protect your Amazon Web Services (AWS) containers with Defender for Containers, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-container-aws

30. Microsoft Security for AWS - Azure Architecture Center, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/architecture/guide/aws/aws-azure-security-solutions

31. Enable Defender for open-source relational databases on AWS (Preview) - Learn Microsoft, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-databases-aws

32. Connect your GCP project - Microsoft Defender for Cloud | Microsoft ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-gcp

33. Protect your Google Cloud Platform (GCP) containers with Defender for Containers, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-container-gcp

34. Defender For Vulnerability Management - Microsoft Security, accessed June 26, 2025, https://secureazcloud.com/f/defenderforvulneralibilitymanagement

35. Vulnerability Management Resources - SANS Institute, accessed June 26, 2025, https://www.sans.org/blog/vulnerability-management-resources/

36. Beyond CVSS: Smarter Vulnerability Prioritization with Exploit Data ..., accessed June 26, 2025, https://www.recastsoftware.com/resources/beyond-cvss-smarter-vulnerability-prioritization/

37. Strategic Recommendation for Transitioning from CVSS to Risk-Based Vulnerability Prioritization - Netpoleon Solutions, accessed June 26, 2025, https://www.netpoleons.com/blog/strategic-recommendation-for-transitioning-from-cvss-to-risk-based-vulnerability-prioritization

38. Risk-Based Vulnerability Management: Prioritize What Matters | Wiz, accessed June 26, 2025, https://www.wiz.io/academy/risk-based-vulnerability-management

39. What is Vulnerability Prioritization? And how to do it right - JAMF Software, accessed June 26, 2025, https://www.jamf.com/blog/vulnerability-prioritization-guide-for-it-experts/

40. CVSS 4.0 and Beyond: A Context-Aware Approach to Vulnerability ..., accessed June 26, 2025, https://www.armis.com/blog/cvss-4-0-and-beyond-a-context-aware-approach-to-vulnerability-risk-assessment/

41. What Is Vulnerability Prioritization? Strategies and Steps - Legit Security, accessed June 26, 2025, https://www.legitsecurity.com/aspm-knowledge-base/vulnerability-prioritization

42. What Is Vulnerability Prioritization? - Picus Security, accessed June 26, 2025, https://www.picussecurity.com/resource/glossary/what-is-vulnerability-prioritization

43. NIST SP 800-53r5 Compliance Guide | Vulnerability Management Best Practices - Brinqa, accessed June 26, 2025, https://www.brinqa.com/blog/nist-800-53-vulnerability-management/

44. Vulnerabilities by ACR - Tenable documentation, accessed June 26, 2025, https://docs.tenable.com/cyber-exposure-studies/application-software-security/Content/VulnerabilitiesACR.htm

45. Risk Prioritization - Tenable documentation, accessed June 26, 2025, https://docs.tenable.com/cyber-exposure-studies/cyber-exposure-insurance/Content/RiskPrioritization.htm

46. Discover Your Most Critical Assets Before Hackers Do | HackerNoon, accessed June 26, 2025, https://hackernoon.com/discover-your-most-critical-assets-before-hackers-do

47. What is Vulnerability Prioritization? | Bitsight, accessed June 26, 2025, https://www.bitsight.com/learn/vulnerability-prioritization

48. Vulnerability Assessment Report: A C-Suite Guide — KEYCALIBER, accessed June 26, 2025, https://www.keycaliber.com/resources/-vulnerability-assessment-report-a-c-suite-guide

49. Why Vulnerability Assessment Reports Fail (& How To Fix It) - PurpleSec, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-assessment-reporting/

50. Why an IAM Assessment is Crucial for Your Cybersecurity Strategy, accessed June 26, 2025, https://www.identityfusion.com/blog/why-an-iam-assessment-is-crucial-for-your-cybersecurity-strategy

51. What is Identity Access Management (IAM)? - CrowdStrike, accessed June 26, 2025, https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-access-management-iam/

52. The Role of IAM in Preventing Cyber Attacks - Infisign, accessed June 26, 2025, https://www.infisign.ai/blog/the-role-of-iam-in-preventing-cyber-attacks

53. The Importance of Identity and Access Management in Safeguarding Your Enterprise, accessed June 26, 2025, https://www.infosecurity-magazine.com/blogs/identity-access-management/

54. What is Privileged Identity Management? - Microsoft Entra ID ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

55. Microsoft Security - Privileged Identity Management (PIM), accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-privileged-identity-management-pim

56. Microsoft Entra Conditional Access | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-conditional-access

57. Configure Microsoft Entra for increased security (Preview), accessed June 26, 2025, https://learn.microsoft.com/en-us/entra/fundamentals/configure-security

58. Microsoft Entra ID (formerly Azure Active Directory) | Microsoft Security, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id

59. Learn about privileged access management | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/purview/privileged-access-management

60. Beware the Hidden Risk in Your Entra Environment - The Hacker News, accessed June 26, 2025, https://thehackernews.com/2025/06/beware-hidden-risk-in-your-entra.html

61. Microsoft nOAuth Flaw Still Exposes SaaS Apps Two Years After Discovery, accessed June 26, 2025, https://www.infosecurity-magazine.com/news/microsoft-noauth-flaw-2025/

62. What is Automated Vulnerability Remediation? - SentinelOne, accessed June 26, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is-automated-vulnerability-remediation/

63. What Is Automated Vulnerability Remediation? | Benefits & Best Practices for Security Teams - Brinqa, accessed June 26, 2025, https://www.brinqa.com/blog/automated-vulnerability-remediation/

64. Automate Threat Response with Playbooks in Microsoft Sentinel ..., accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks

65. Vulnerability Management Automation: Here's Why You Need it - Swimlane, accessed June 26, 2025, https://swimlane.com/blog/automating-vulnerability-lifecycle-management/

66. Vulnerability Management in Microsoft Azure - NubOps, accessed June 26, 2025, https://www.nubops.com/blog/2024/02/22/vulnerabilities/

67. Automating Threat Detection and Response with Microsoft Sentinel Playbooks - ne Digital, accessed June 26, 2025, https://www.nedigital.com/en/blog/automating-threat-detection-and-response-with-microsoft-sentinel-playbooks

68. Automation in Microsoft Sentinel, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/sentinel/automation/automation

69. Automate threat response with playbooks in Microsoft Sentinel - GitHub, accessed June 26, 2025, https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/automation/automate-responses-with-playbooks.md

70. Azure Logic Apps | Microsoft Azure, accessed June 26, 2025, https://azure.microsoft.com/en-us/products/logic-apps

71. Overview - Azure Logic Apps | Microsoft Learn, accessed June 26, 2025, https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-overview

72. Automated remediation in Azure - Netskope Community, accessed June 26, 2025, https://community.netskope.com/security-posture-management-4/automated-remediation-in-azure-5876

73. Mastering SANS Vulnerability Management: A Comprehensive Guide - Astra Security, accessed June 26, 2025, https://www.getastra.com/blog/compliance/sans/sans-vulnerability-management/

74. Vulnerability Management Policy: 3 Examples and 6 Best Practices | Sternum IoT, accessed June 26, 2025, https://sternumiot.com/iot-blog/vulnerability-management-policy-3-examples-and-6-best-practices/

75. Best Practices for SLA Vulnerability Management - FortifyFramework.com, accessed June 26, 2025, https://www.fortifyframework.com/sla-vulnerability-management/

76. Nucleus Blog | Adapt Vulnerability Management Service Level ..., accessed June 26, 2025, https://nucleussec.com/blog/how-to-adapt-vulnerability-management-service-level-agreements-to-team-maturity/

77. How Soon Should Vulnerabilities Be Patched? - Tandem, accessed June 26, 2025, https://tandem.app/blog/how-soon-should-vulnerabilities-be-patched

78. Vulnerability Management SLAs: A Guide - HostedScan.com, accessed June 26, 2025, https://hostedscan.com/blog/vulnerability-management-slas-guide

79. Vulnerability Remediation | safecomputing.umich.edu, accessed June 26, 2025, https://safecomputing.umich.edu/protect-the-u/protect-your-unit/vulnerability-management/remediation

80. FortifyData's Alignment with NIST SP 800-40, accessed June 26, 2025, https://fortifydata.com/blog/fortifydata-alignment-with-nist-sp-800-40/

81. Microsoft Defender Vulnerability Management Plans and Pricing, accessed June 26, 2025, https://www.microsoft.com/en-us/security/business/threat-protection/microsoft-defender-vulnerability-management-pricing

82. Top 10 Vulnerability Management Metrics & KPIs To Measure Success, accessed June 26, 2025, https://purplesec.us/learn/vulnerability-management-metrics/

83. 15 Vulnerability Management Metrics to Measure your Program - Wiz, accessed June 26, 2025, https://www.wiz.io/academy/vulnerability-management-metrics

84. Vulnerability Management Reports | Rootshell Security, accessed June 26, 2025, https://www.rootshellsecurity.net/vulnerability-management-reports/

85. Using the SANS Vulnerability Management Maturity Model in Your Vulnerability Management Process - RH-ISAC, accessed June 26, 2025, https://rhisac.org/vulnerability-management/sans-maturity-model-process/

86. 15 Key Vulnerability Management Metrics for Success - Legit Security, accessed June 26, 2025, https://www.legitsecurity.com/aspm-knowledge-base/top-vulnerability-management-metrics

87. Vulnerability Management Metrics: 5 Metrics to Start Measuring in ..., accessed June 26, 2025, https://www.sans.org/blog/5-metrics-start-measuring-vulnerability-management-program/

88. Automated Remediation: Benefits, Best Practices & Use Cases - Tamnoon, accessed June 26, 2025, https://tamnoon.io/blog/automated-cloud-remediation-guide/

89. How to report on vulnerability management to the board - Intruder.io, accessed June 26, 2025, https://www.intruder.io/blog/reporting-to-the-board-how-to-talk-about-vulnerability-management

90. Vulnerability Dashboard using Microsoft Power BI - YouTube, accessed June 26, 2025,

1. How to Create a Custom Security & Threat Dashboard in Power BI, accessed June 26, 2025, https://www.techrepublic.com/article/how-to-visualise-security-and-threat-information-in-power-bi/

2. RAPID 7 as a source for Vulnerabilities dashboard - Microsoft Fabric Community, accessed June 26, 2025, https://community.powerbi.com/t5/Desktop/RAPID-7-as-a-source-for-Vulnerabilities-dashboard/td-p/2284223