Work out vulnerability risk priority instantly with clear inputs, formula shown and shareable results.
A useful priority combines severity, likelihood and context multiplicatively: CVSS for how bad, EPSS for how likely, asset criticality for what it protects, and exposure for whether an attacker can reach it. Because the factors multiply, a 9.8 CVSS on an isolated system with a 0.001 EPSS lands far below a 6.5 on an internet-facing crown jewel with active exploitation.
Risk priority
score = CVSS x EPSS x (asset criticality / 5) x exposure factor x 10; exposure factors: internet 1.0, internal 0.6, isolated 0.2
Because a zero on any dimension should collapse the priority. An unreachable vulnerability on a worthless asset is not urgent no matter how severe it is in the abstract.
Yes. Anything on the CISA KEV list should be treated as P1 regardless of the computed score, since exploitation is a fact rather than a probability.