> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency.md). # Urgency Urgency transitions security teams from reactive severity-only triage to proactive context-aware prioritization. Static severity (Critical, High, Medium, Low) reflects the theoretical impact of a vulnerability but does not account for whether the vulnerability is deployed, internet-exposed, actively exploited, or affecting a business-critical application. Urgency incorporates these runtime and business signals to surface the issues that pose the greatest real-world risk. ## How Urgency is calculated Urgency is a dynamic risk score with two dimensions: `Urgency = Probability (likelihood of exploitation) × Impact (potential damage)` * **Runtime exposure**: Is the vulnerable asset deployed, exposed to the internet, or can be exploited to leverage privileged capabilities in case of an attack? * **Business impact:** Is the application critical to the business? Does the asset access sensitive data? * **Exploitability**: Is there a known exploit (CISA KEV, EPSS)? Is the exploit mature and available? * **Protection status**: Is the runtime asset protected by a Cortex XDR/XSIAM agent? High agent coverage can downgrade an issue's urgency level by mitigating the immediate risk * **Probability**: Incorporates signals such as EPSS score, CISA KEV status, exploit maturity, reachability, internet exposure, deployment status, and runtime agent protection coverage * **Impact**: Incorporates signals such as application criticality, application environment, access to sensitive data, leverage of privileged capabilities, and the number of affected assets The following Urgency metrics are shared across all scanner types. The Urgency engine evaluates these common signals for every issue, regardless of the detection method. * **Applications**: Data from applications created in Cortex Cloud. Higher application criticality increases urgency. Critical and High applications receive elevated urgency classification * **Runtime**: Percentage of affected deployed assets with runtime protection, either directly or via a host-level agent. Only active agents are counted. Higher runtime agent protection coverage reduces urgency because the runtime agent can detect and block exploitation attempts * **Code**: Findings from native Cortex Cloud Application Security scanners and ingested third party sources * **Risk metadata**: External threat context aggregated from third-party sources * **Asset metadata**: Contextual information associated with the asset where the finding was detected, including any enrichments. For example, a vulnerability is a finding on a software package, and its enrichment could include related repository data For a detailed breakdown of the specific Urgency parameters defined by each scanner type, see [Urgency metrics](/application-security/application-security-posture-management-aspm/urgency/urgency-metrics.md). ## Urgency levels * **Top Urgent**: Highest risk — the issue affects a deployed, internet-exposed, or business-critical asset with active exploit intelligence or confirmed exploitability. Immediate remediation required * **Urgent**: Important issues to address soon, such as deployed assets with moderate risk, or high-risk issues that are effectively mitigated by runtime agents * **Not Urgent**: Requires attention, but can be addressed within your organization SLA (Service Level Agreement) * **Not Applicable**: Issues where Urgency is not calculated including PR/CI scans or pending periodic calculation ## Why use Urgency * **Reducing remediation noise**: Urgency isolates issues that affect deployed, internet-exposed, or business-critical assets. * **Accelerating triage**: Urgency prioritizes remediation using exploit intelligence, runtime context, and business criticality. * **Enabling SLA compliance**: Urgency tiers map directly to SLA targets and remediation velocity. * **Incorporating compensating controls**: Urgency lowers scores when active protections reduce immediate risk. ## Explore Urgency topics Choose a topic based on what you need to do next: * [Review Application Security posture and remediate issues by Urgency](/application-security/application-security-posture-management-aspm/urgency/view-urgency-in-the-tenant.md) to filter, investigate, and remediate issues. * [Understand Urgency and code-to-cloud traceability](/application-security/application-security-posture-management-aspm/urgency/urgency-and-code-to-cloud-traceability.md) to learn how lineage influences Urgency. * [Understand Urgency metrics](/application-security/application-security-posture-management-aspm/urgency/urgency-metrics.md) to inspect each calculation signal. * [Prioritize issue types by Urgency level](/application-security/application-security-posture-management-aspm/urgency/prioritize-issues-by-urgency-levels.md) to compare classifications by scanner type. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.