Skip to content
ENExplore Calculators

Vulnerability Risk Priority Calculator

Work out vulnerability risk priority instantly with clear inputs, formula shown and shareable results.

About Vulnerability Risk Priority Calculator

A useful priority combines severity, likelihood and context multiplicatively: CVSS for how bad, EPSS for how likely, asset criticality for what it protects, and exposure for whether an attacker can reach it. Because the factors multiply, a 9.8 CVSS on an isolated system with a 0.001 EPSS lands far below a 6.5 on an internet-facing crown jewel with active exploitation.

Formula

Risk priority

score = CVSS x EPSS x (asset criticality / 5) x exposure factor x 10; exposure factors: internet 1.0, internal 0.6, isolated 0.2

Worked example

With the default values below, Vulnerability Risk Priority Calculator returns Risk priority score (0-100) of 30.80. Change any input above and every figure here is recalculated in your browser.

Inputs used

CVSS scoreaccepts 0–10
8.8
EPSS probabilityaccepts 0–1
0.35
Asset criticality (1-5)accepts 1–5
5
Network exposureone of Internet facing, Internal only, Isolated / air-gapped
Internet facing

Results

Risk priority score (0-100)
30.80
Suggested remediation SLA
30 days
Exposure multiplier applied
1.00
Priority band
P2 - patch within a month

Step by step

  1. 1Values used
  2. 2Risk priority
  3. 3Risk priority score (0-100)= 30.80
  4. 4Suggested remediation SLA= 30 days
  5. 5Exposure multiplier applied= 1.00
  6. 6Priority band= P2 - patch within a month

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why multiply rather than add the factors?

Because a zero on any dimension should collapse the priority. An unreachable vulnerability on a worthless asset is not urgent no matter how severe it is in the abstract.

Should known-exploited vulnerabilities bypass this?

Yes. Anything on the CISA KEV list should be treated as P1 regardless of the computed score, since exploitation is a fact rather than a probability.

Related Calculators

Vulnerability Risk Priority Calculator | Calcrivo