Fix the flaws attackers are using first. Not just the ones that sound worst.
We score every published flaw from 0 to 100 using evidence it is being exploited, its severity, how widely it is exposed and threat activity. It is for anyone with more flaws than time to fix them.
What goes into the score? Four things, in order.
Every flaw gets a score from 0 to 100. Evidence that attackers are using it counts most. Behind each part is a lot of data, kept up to date.
01 · Biggest factor
Evidence it is being exploited
- 1,700+flaws confirmed as exploited
- 900+threat groups tracked
- Liveattack data from internet sensors
02 · Strong factor
How severe it is
- 400,000+flaws rated and classified
03 · Smaller factor
How widely exposed it is
- 180,000+products
- 37,000+vendors
04 · Smaller factor
Threat activity
- 400+ransomware groups
- 15industry groups
How is it worked out? Every flaw, kept current.
The score is not set once and forgotten. We keep rescoring every published flaw as new evidence comes in, so when attackers start using one, it moves up your list.
- When a flaw is published
It joins the catalogue
Every published flaw, over 400,000 so far, gets a risk score. Not just the ones in the news.
- Continuously
We gather the evidence
We keep collecting evidence of attacks, severity, exposure and threat activity for every flaw.
- As evidence changes
The evidence becomes a score
Exploitation evidence counts most, then severity, then exposure and threat activity. Together they make a score from 0 to 100, and a band from Info to Critical.
- In your account
Your list is re-ranked
The flaws in software you track are sorted riskiest first. You hear as soon as we know that one has become known-exploited or its exploit likelihood has risen.
Why not just sort by severity? Because it ignores attackers.
A severity rating says how bad a flaw could be if someone used it. It says nothing about whether anyone is. Sort by severity alone and a flaw attackers are using today can sit below several that nobody is touching.
- Severity still counts, second only to evidence of attacks. It just is not the whole story.
- Evidence of attacks moves a flaw up. In the example, a web server flaw rated 7.5 for severity ranks second, because it is known to be exploited.
- Lack of evidence moves one down. Desk phones rated 9.8 fall to last: no public exploit code and little sign of attacks.
Your own list is sorted this way, riskiest first. See how it is built
Severity rating 0 to 10 · Risk score 0 to 100
What do the bands mean? Critical is rare, on purpose.
Every score falls into one of five bands. Because the score weighs real evidence of attacks, very few flaws reach the top: under 1% of all published flaws score Critical.
- Critical is 85 and above, High is 70 to 84, Medium 40 to 69, Low 20 to 39 and Info 0 to 19.
- 1,188 flaws are Critical and 1,909 High, out of over 400,000. Fewer than 1 in 100 land in either band.
A short top band means a short list to start on, instead of hundreds of flaws all marked urgent.
Critical 85+ · High 70 to 84 · Medium 40 to 69 · Low 20 to 39 · Info 0 to 19
| Band | Score | Flaws | Share |
|---|---|---|---|
| Critical | 85 to 100 | 1,188 | 0.3% |
| High | 70 to 84 | 1,909 | 0.5% |
| Medium | 40 to 69 | 226,791 | 55.7% |
| Low | 20 to 39 | 81,438 | 20.0% |
| Info | 0 to 19 | 96,027 | 23.6% |
It means fixing security flaws in order of real risk rather than working down a list sorted by severity. We give every published flaw a 0 to 100 score from four parts: evidence it is being exploited, how severe it is, how widely exposed it is and threat activity.
A severity rating describes how bad a flaw could be if used. The risk score includes severity, but evidence of real exploitation counts for more, and it also considers exposure and threat activity. So a flaw attackers are using can outrank one that only sounds worse.
No, and we do not claim it does. It weighs the evidence available today to put your list in a sensible order. It is a way to decide what to fix first.
Critical is 85 and above, High 70 to 84, Medium 40 to 69, Low 20 to 39 and Info 0 to 19. Under 1% of all published flaws score Critical.
We keep rescoring every published flaw as new evidence comes in. And when a flaw in software you track becomes known-exploited or its exploit likelihood rises, we tell you as soon as we know.
On every flaw in the vulnerability library, and on your own list of flaws matched from the software you track, sorted riskiest first.
Start with what matters most. Not with what sounds worst.
Add the software you run and see your own flaws ranked riskiest first, by a score that puts evidence of real attacks ahead of severity and keeps up as that evidence changes.