# Risk-based prioritisation | Precursor Intelligence

**Fix the flaws attackers are using first. Not just the ones that sound worst.**

> Risk-based prioritisation ranks security flaws by how risky they really are, not just how bad they sound. We give every published flaw a score from 0 to 100, built from evidence it is being exploited, its severity, how widely it is exposed and threat activity. It is for anyone with more flaws to fix than time to fix them.

Canonical page: https://www.precursorintelligence.com/features/risk-based-prioritisation
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Risk-based prioritisation
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Every published flaw scored. Always kept up to date. Five bands, Info to Critical.

Example: two flaws both rated critical for severity score very differently. CVE-2024-3400 (VPN gateway, severity 10.0, confirmed exploited) scores 89.0, Critical, because it is confirmed exploited, the factor that counts most. CVE-2023-20078 (desk phone admin page, severity 9.8, no public exploit code) scores 51.6, Medium: just as severe, but with little sign of anyone exploiting it. Example company data uses the fictional Acme.

## Contents

1. [What goes into the score?](#what-goes-into-the-score)
2. [How is it worked out?](#how-is-it-worked-out)
3. [Why not just sort by severity?](#why-not-just-sort-by-severity)
4. [What do the bands mean?](#what-do-the-bands-mean)
5. [Questions](#questions)
6. [Related features](#related-features)

## What goes into the score?

Every flaw gets a score from 0 to 100. Evidence that attackers are using it counts most. Behind each part is a lot of data, kept up to date. The four parts, from the one that counts most:

1. **Exploitation (the biggest factor).** 1,700+ flaws confirmed as exploited, 900+ threat groups tracked, and live attack data from internet sensors.
2. **Severity.** 400,000+ flaws rated and classified.
3. **Exposure.** 180,000+ products and 37,000+ vendors.
4. **Threat activity.** 400+ ransomware groups and 15 industry groups.

## How is it worked out?

The score is not set once and forgotten. We keep rescoring every published flaw as new evidence comes in, so when attackers start using one, it moves up your list.

1. **It joins the catalogue (when a flaw is published).** Every published flaw, over 400,000 so far, gets a risk score. Not just the ones in the news.
2. **We gather the evidence (continuously).** We keep collecting evidence of attacks, severity, exposure and threat activity for every flaw.
3. **The evidence becomes a score (as evidence changes).** Exploitation evidence counts most, then severity, then exposure and threat activity. Together they make a score from 0 to 100, and a band from Info to Critical. For example, the VPN gateway flaw scores 89.0, Critical.
4. **Your list is re-ranked (in your account).** The flaws in software you track are sorted riskiest first. You hear as soon as we know that one has become known-exploited or its exploit likelihood has risen.

## Why not just sort by severity?

**Because it ignores attackers.** A severity rating says how bad a flaw could be if someone used it. It says nothing about whether anyone is. Sort by severity alone and a flaw attackers are using today can sit below several that nobody is touching.

- **Severity still counts,** second only to evidence of attacks. It just is not the whole story.
- **Evidence of attacks moves a flaw up.** In the example, a web server flaw rated 7.5 for severity ranks second, because it is known to be exploited.
- **Lack of evidence moves one down.** Desk phones rated 9.8 fall to last: no public exploit code and little sign of attacks.

The same seven real flaws, ranked two ways:

| Flaw | Severity rating (0 to 10) | Rank by severity | Risk score (0 to 100) | Rank by risk |
|---|---|---|---|---|
| VPN gateway, CVE-2024-3400 (known exploited) | 10.0 | 1 | 89.0 Critical | 1 |
| Download tool, CVE-2023-38545 | 9.8 | 2 | 69.5 Medium | 4 |
| Desk phones, CVE-2023-20078 | 9.8 | 3 | 51.6 Medium | 7 |
| Mail server, CVE-2023-42116 | 9.8 | 4 | 56.2 Medium | 6 |
| Secure shell server, CVE-2024-6387 | 8.1 | 5 | 70.6 High | 3 |
| Web servers (HTTP/2), CVE-2023-44487 (known exploited) | 7.5 | 6 | 76.1 High | 2 |
| Secure shell connections, CVE-2023-48795 | 5.9 | 7 | 63.7 Medium | 5 |

Your own list is sorted this way, riskiest first. See [vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management).

## What do the bands mean?

**Critical is rare, on purpose.** Every score falls into one of five bands. Because the score weighs real evidence of attacks, very few flaws reach the top: under 1% of all published flaws score Critical.

| Band | Score | Published flaws (14 October 2026) | Share |
|---|---|---|---|
| Critical | 85 to 100 | 1,188 | 0.3% |
| High | 70 to 84 | 1,909 | 0.5% |
| Medium | 40 to 69 | 226,791 | 55.7% |
| Low | 20 to 39 | 81,438 | 20.0% |
| Info | 0 to 19 | 96,027 | 23.6% |

- Fewer than 1 in 100 flaws land in Critical or High.
- A short top band means a short list to start on, instead of hundreds of flaws all marked urgent.

## Questions

### What is risk-based vulnerability prioritisation?

It means fixing security flaws in order of real risk rather than working down a list sorted by severity. We give every published flaw a 0 to 100 score from four parts: evidence it is being exploited, how severe it is, how widely exposed it is and threat activity.

### How is the risk score different from a severity rating?

A severity rating describes how bad a flaw could be if used. The risk score includes severity, but evidence of real exploitation counts for more, and it also considers exposure and threat activity. So a flaw attackers are using can outrank one that only sounds worse.

### Does the score predict which flaw will be used against me?

No, and we do not claim it does. It weighs the evidence available today to put your list in a sensible order. It is a way to decide what to fix first.

### What do the bands mean?

Critical is 85 and above, High 70 to 84, Medium 40 to 69, Low 20 to 39 and Info 0 to 19. Under 1% of all published flaws score Critical.

### How often is the score updated?

We keep rescoring every published flaw as new evidence comes in. And when a flaw in software you track becomes known-exploited or its exploit likelihood rises, we tell you as soon as we know.

### Where do I see it?

On every flaw in the vulnerability library, and on your own list of flaws matched from the software you track, sorted riskiest first.

## Related features

- [Vulnerability management](https://www.precursorintelligence.com/features/vulnerability-management): tell us the software you run and see only the known flaws that affect it.
- [AI action plans](https://www.precursorintelligence.com/features/ai-action-plans): a written, prioritised fix plan for your top risks, step by step.
- [Threat intelligence](https://www.precursorintelligence.com/features/threat-intelligence): who targets businesses like yours, how they work and which flaws they use.
- [Alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting): alerts by email, in the app or by webhook as soon as we spot something.
- [All features](https://www.precursorintelligence.com/features)

## Start with what matters most. Not with what sounds worst.

Add the software you run and see your own flaws ranked riskiest first, by a score that puts evidence of real attacks ahead of severity and keeps up as that evidence changes.

[Start free](https://www.precursorintelligence.com/register) · [Book a demo](https://www.precursorintelligence.com/contact)