The rubric
How verdicts are decided.
Every call is worked out from facts about your placement, not typed in. If a record ever differs from the rubric, it says so, with a reason.
The four tiers
- Tier 1
Emergency
Drop everything. Give up the evening or weekend if you have to.
- Tier 2
Urgent
Get it done as soon as you can, ahead of everything planned.
- Tier 3
Prioritised
Sooner than your normal patching cycle. Schedule it.
- Tier 4
Routine
Normal patching. No special action, and not tracked on this site.
Each tier says what it means but never gives a time frame. That depends on your risk appetite and SLAs, so you set it.
Step 1: the gates
These are checked first and can settle the tier on their own.
- If the vendor states a condition for exposure is false, it is not exposed: Tier 4, Routine.
- If it is not reachable from the internet, it is Tier 4, Routine. Normal patching is enough.
If it is unclear whether something is exposed, it is treated as exposed.
Step 2: business impact and evidence
Pick the row for your placement and the column for the evidence. The same flaw can be Critical on the server that holds your customer database and Limited on a test box.
| Impact | Exploited or imminent | Demonstrated | No evidence |
|---|---|---|---|
| Critical | Tier 1Emergency | Tier 2Urgent | Tier 3Prioritised |
| Significant | Tier 2Urgent | Tier 3Prioritised | Tier 4Routine |
| Limited | Tier 3Prioritised | Tier 4Routine | Tier 4Routine |
Impact rows
- Critical
- Control of the system, your most sensitive data (customer or regulated data, credentials, a production database), or an essential service going down and staying down.
- Significant
- A foothold that needs another step, moderately valuable data, or an essential service going down but recovering on its own, such as a restart.
- Limited
- Low-value information that does not help an attacker go further, such as version numbers, or a non-essential service going down.
Evidence columns
- Exploited or imminent
- Attacks are happening, a reliable exploit is public or circulating, or attackers are scanning for it.
- Demonstrated
- A proof of concept or a credible researcher claim, but no reliable exploit in use.
- No evidence
- Nothing shows it can be exploited yet.
Evidence counts for what it actually achieves. Attacks or a proof of concept that only crash a service do not make a takeover urgent, however capable the flaw is. The call follows the lesser outcome, and the full outcome counts only as demonstrated.
“Imminent” is a judgement. It means a reliable exploit for the full outcome is public or circulating, attackers are scanning for it, or the patch is trivial to turn into an exploit. Every record that uses it explains why and cites the source.
If you cannot tell how bad it would be, use the Critical row.
Step 3: two adjustments
- If it needs a login or an unusual configuration, the call drops one tier.
- If EPSS is at or above 50%, a call that rests on exploitation or a public exploit rises one tier. EPSS never lowers a tier.
Exploit chains
Attackers rarely stop at one flaw. A flaw that is minor on its own can be the first step in a known chain that ends in a takeover.
- A flaw is rated by the worst outcome of any known chain with other flaws that are likely to be on the same system.
- The evidence for the chain as a whole is used, and if the chain gets round a login, the login adjustment does not apply.
- If you have already fixed the other link, rate the flaw on its own. Every record that relies on a chain names it and cites the source.
Where CVSS fits
CVSS scores how bad a flaw could be in the worst case, for anyone, anywhere. It does not know what you run, whether it can be reached, or whether anyone is attacking it.
So a 9.8 on a system nobody can reach is Tier 4, and a 6.5 that attackers are using against your VPN can be Tier 2. The score never sets a tier. The business impact row does that job, in terms of your own systems. The score is still shown on each verdict for reference.