Cortex Vulnerability Risk Score

Learn how Cortex Cloud calculates and displays CVRS to prioritize vulnerability remediation.

Cortex's Vulnerability Risk Score (CVRS) offers a dynamic vulnerability risk-scoring approach to help you synthesize critical organization-specific information along with public vulnerability intelligence to provide customized accurate risk scoring. Leverage CVRS to bring in asset context, exploitability information, and the latest updates, to your risk assessment.

Cortex Vulnerability Risk Scores range from 0 to 100, with 100 representing the highest risk. Scores are updated on a daily basis or whenever a findings revision takes place. They are included on vulnerability findings and issues to enable efficient sorting and filtering of vulnerabilities based on risk. Find more details about the risk factors that determine each score on the issue details panel.

Use CVRS to quickly analyze, report, and remediate the highest-priority issues. In addition, CVRS helps you inform and align your team, so you can focus on the most critical issues.

CVRS Assessment Framework

Cortex Cloud uses the following factors to determine the CVRS.

Risk factor	Description
Vulnerability Context	Uses the CVSS base score
Exploit Intelligence	Uses EPSS, CISA KEV, exploited in-the-wild, and exploit maturity data
Asset Risk	Evaluates public internet-exposed assets
Environment Risk	Leverages Attack Surface testing results to determine whether an asset is a package-in-use
Compensating Controls	Accounts for assets with Compensating Controls (requires Exposure Management add-on)

View Cortex Vulnerability Risk Score

The CVRS is displayed in the Vulnerability Issues table and details are included in the issue details.

1. Navigate to Posture Management → Vulnerability Management → Vulnerability Issues.

   The Cortex Vulnerability Risk Score appears in the CVRS column in the table.
2. Click on a row in the table to open the details panel.

   The Overview tab includes the vulnerability risk score, and the Evidence section includes a high-level summary of the evidence used to determine that score.

   The Risk Details tab provides details about each risk factor thatCortex Cloud uses to determine the risk score.

You can also find the Cortex Vulnerability Risk Score and high-level risk score evidence on vulnerability findings.