Understand Risk Prioritization
You cannot fix everything at once, and you do not need to. Most of your real risk sits in a small number of findings. Risk prioritization helps you find those findings first, by asking three questions: How important is the asset? What does it mean for the business? Is anyone attacking it?
Where you use it: Risk Management > Risk Workbench
Why Risk Prioritization Matters
Your security tools find new issues every day. The list grows faster than any team can fix it. If you work through it in the order it arrives, or only by severity, you can spend weeks on findings that pose little real danger, while a few serious ones stay open.
Prioritization narrows the list step by step:
- All findings: every vulnerability and misconfiguration on every asset.
- Findings that carry real risk: on important assets, with a real chance of attack.
- Fix first: the few fixes that lower your risk the most.
The goal is not a shorter list. The goal is the right list.
Benefits
| Benefit | How prioritization helps |
|---|---|
| Use your resources well | Put your limited time and staff on the most critical findings and the most important assets. |
| Lower risk faster | Fix the findings that attackers are most likely to use, so each fix removes more risk. |
| Meet requirements on time | Many regulations require you to fix critical vulnerabilities quickly. Prioritization helps you meet those deadlines. |
| Cut the noise | Set low-risk findings aside for now, so your team can focus on what matters most. |
Risk-Based vs Severity-Based Prioritization
Severity tells you how bad a finding is in general. It is the same for every organization. Risk tells you how bad the finding is for you. It depends on where the finding is, what that asset does for your business, and whether attackers are using it.
Which Would You Fix First?
You have time to fix one finding today. Here are your two choices.
| Finding A | Finding B | |
|---|---|---|
| Severity | Critical | Medium |
| Asset | A test server with no internet access | An internet-facing payment server |
| Threat | No known exploit, and no attacks seen | Actively exploited, with known threat actors |
| Business importance | Low | Highest |
| Severity-based answer | Fix first, because its severity is higher | Fix later |
| Risk-based answer | Fix later | Fix first. It is easy to reach, attackers are using it, and it sits on an asset your business depends on. |
Compare the Two Approaches
| Severity-based | Risk-based | |
|---|---|---|
| Asks | How bad is this finding in general? | How bad is this finding for my organization, right now? |
| Looks at | The finding only | The finding, the asset, the business, and current threats |
| Result | A long list of “critical” items that all look equally urgent | A short, ranked list of the fixes that matter most |
| In ETM | Severity, CVSS, and QVSS scores | TruRisk™ scores |
Severity still matters. Risk-based prioritization does not ignore it. It uses severity as one input, and adds the context around it.
Asset-Based Prioritization
The same finding means very different things on different assets. Asset-based prioritization asks: how important is the asset, and how easy is it to reach?
Asset Criticality Score (ACS)
The Asset Criticality Score shows how important an asset is to your organization, on a scale of 1 to 5.
| ACS | Meaning |
|---|---|
| 1 | Low importance |
| 2 | Minor |
| 3 | Medium |
| 4 | High |
| 5 | Business critical (Crown Jewel) |
What Makes an Asset a Priority
| Factor | Why it matters |
|---|---|
| Criticality | Assets with a high ACS, such as 4 or 5, come first. |
| Exposure | Internet-facing assets are easier for attackers to reach than internal ones. |
| Asset TruRisk score | A score from 0 to 1000 that sums up the risk on the asset. A higher score means more risk. |
| Connections | An asset that leads to other important assets can be a stepping stone for an attacker. See About Attack Path. |
Keep your Asset Criticality Scores up to date. Prioritization is only as good as the asset context behind it.
Business-Based Prioritization
Security teams think in assets. Leaders think in business services, such as payments, customer data, or manufacturing. Business-based prioritization asks: what does this risk mean for the business?
| Concept | How it helps you prioritize |
|---|---|
| Business Entities | Groups of assets that support the same part of your business. You can prioritize one Business Entity at a time, such as all the assets behind your online store. |
| Business value | How much a Business Entity matters to your organization. ETM uses it with TruRisk to show your riskiest Business Entities. |
| Risk appetite | The level of risk your organization is willing to accept. Business Entities with a TruRisk score above your risk appetite need attention first. |
| Custom factors | Adjust TruRisk scores to fit your business. Risk factors raise the score for conditions that matter to you. Compensatory factors lower it when strong protections, such as a firewall, are in place. |
Reporting to leadership? Prioritize by Business Entity. It links each fix to a business service that people outside security understand.
Threat-Based Prioritization
A vulnerability that no one is attacking can often wait. One that attackers are using today cannot. Threat-based prioritization asks: is anyone using this finding to attack, and how likely are they to?
| Signal | What it tells you |
|---|---|
| Exploitability | Actively Exploited means attacks in the past 30 days. Exploited means attacks more than 30 days ago. Weaponized, POC, or No Exploit means no active attacks. |
| CISA KEV | The vulnerability is on the CISA Known Exploited Vulnerabilities list, so attacks are confirmed in the real world. |
| Threat actors and malware | Known attacker groups, ransomware, or malware use the vulnerability. |
| Real Threat Indicators (RTI) | Signals such as Easy Exploit, Exploit Public, and Predicted High Risk. |
| EPSS score | The chance that the vulnerability will be exploited in the near future. |
| TruConfirm validation | If TruConfirm is on, it shows whether the exploit actually works in your environment. |
Threats change every day. A finding that was safe to delay last month can become urgent today, so review your priorities often.
How ETM Brings It Together
Each approach answers one question. You get the clearest picture when you use all three together. ETM does this for you with the TruRisk™ score.
Asset (how important and exposed is it?) + Business (what does it mean for the business?) + Threat (is anyone attacking it?) = TruRisk™ (what should I fix first?)
In the Risk Workbench, you can put these ideas to work:
- Choose a scope by Business Entity or asset tags.
- Use the Highest Risk Reduction approach to let ETM rank findings by risk for you.
- Or click Let Me Decide, and filter by asset, business, and threat details yourself.
Next: Understand the Risk Workbench. See where you turn these ideas into a prioritization plan.