Reference A: Prioritization metrics

Urgency-based prioritization

Urgency combines runtime exposure, business impact, exploit intelligence, reachability, and fix availability to prioritize each CVE vulnerability issue. Use the following hierarchy:

Urgency Level	Criteria	Recommended Action
Top Urgent	High EPSS, KEV-listed, reachable, and affecting an internet-exposed production asset with critical application criticality	Upgrade immediately. Escalate to a Case. Apply compensating controls if no fix exists
Urgent	High CVSS, a fix is available, and affects a staging or production asset, or sensitive data	Upgrade within the current SLA window
Not Urgent	Low EPSS, not reachable, or affects a low-criticality development or testing asset	Schedule remediation during the next maintenance cycle
Not Applicable	No Code-to-Cloud trace exists and SCA-specific signals are unavailable	Link the repository to the relevant application

For detailed metric definitions and calculation context, see Urgency and Understand Urgency metrics.

Important

Urgency signals related to deployment context are populated only when the SCA asset is traced to deployed cloud resources through the Code-to-Cloud mapping. If no Code-to-Cloud trace exists, deployment-related urgency signals display as Not Applicable. SCA-specific signals (EPSS Score, KEV Status, Reachability, Has Fix) are always available regardless of Code-to-Cloud traceability.

Severity-based prioritization

Severity reflects inherent CVE risk from its CVSS score. Use it as a baseline filter:

Severity	Remediation Priority
Critical	Remediate immediately. The vulnerability enables remote code execution, privilege escalation, or data exfiltration with low attack complexity
High	Remediate within the current sprint. The vulnerability exposes a significant attack vector
Medium	Schedule remediation. The vulnerability requires specific exploitation conditions
Low	Address during routine maintenance. The vulnerability has minimal security impact
Informational	No action required. The finding is advisory

CVE details

The CVE details section provides vulnerability intelligence for the detected CVE:

• CVE ID: The Common Vulnerabilities and Exposures identifier with a link to the NVD entry.
• CVSS Score: The CVSS v3.1 base score and severity rating.
• EPSS Score: The Exploit Prediction Scoring System probability with percentile ranking.
• KEV Status: Whether the CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
• Attack Vector: The attack vector classification (Network, Adjacent, Local, Physical).
• Attack Complexity: The complexity required to exploit the vulnerability (Low, High).
• Published Date: The date the CVE was published in the NVD.
• Description: The full CVE description from the NVD advisory.

Package details

The Package details section provides dependency context for the vulnerable package:

• Package Name: The name of the vulnerable open-source package.
• Installed Version: The version declared in the dependency manifest.
• Fix Version: The minimum package version that resolves the vulnerability.
• Root Package: The top-level dependency that introduces a transitive vulnerability.
• Dependency Path: The full dependency chain from the root package.
• Package Manager: The package manager ecosystem, such as npm, Maven, or PyPI.
• License: The open-source license of the vulnerable package.

Code evidence

The Code evidence section displays source context for the vulnerable dependency:

• Repository Name: The repository containing the vulnerable dependency.
• File Path: The dependency manifest path with a VCS provider link.
• Code Block: The manifest snippet with the vulnerable declaration highlighted.
• Commit Details: The author, hash, and timestamp of the introducing commit.

Code to cloud graph

The Code to cloud graph traces the dependency manifest to its deployed cloud resource. Use it to understand which production assets inherit the vulnerable package.