3.3. Analyzing Data to Prioritize Vulnerabilities

💡 First Principle: Vulnerability prioritization is a risk calculation, not a sorting exercise — the goal is identifying which vulnerabilities, in your specific environment, with your specific threat landscape, represent the greatest actual risk if left unpatched.

CVSS provides a severity score. Risk requires adding context: is this system internet-facing? Is there a public exploit? Is this asset business-critical? Could an attacker chain this with another vulnerability? The analyst who answers "patch by CVSS order" will patch the wrong things first.

⚠️ Common Misconception: A CVSS 9.8 vulnerability always requires immediate remediation. A CVSS 9.8 RCE on an isolated test server with no sensitive data and no internet exposure may be lower priority than a CVSS 6.5 authentication bypass on your public-facing customer portal. Context is everything.