Prioritise vulnerability remediation effort across severity levels.
Weighting by severity prevents a long tail of low findings from masking a single critical issue. Separating priority hours from total hours is what makes the remediation plan schedulable. Most reported vulnerabilities are not reachable from the application's code paths, so triage by exploitability matters as much as severity when allocating the hours.
SBOM/Vulnerability Scanner
Risk score = 40 × critical + 10 × high + 3 × medium + 1 × low
Risk score = 40 × critical + 10 × high + 3 × medium + 1 × low Weighting by severity prevents a long tail of low findings from masking a single critical issue. Separating priority hours from total hours is what makes the remediation plan schedulable.
Most reported vulnerabilities are not reachable from the application's code paths, so triage by exploitability matters as much as severity when allocating the hours.
This calculator takes 5 inputs: Critical vulnerabilities, High vulnerabilities, Medium vulnerabilities, Low vulnerabilities, Average hours per remediation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.