> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/cortex-vulnerability-risk-score.md).

# Cortex Vulnerability Risk Score

Cortex's Vulnerability Risk Score (CVRS) offers a dynamic vulnerability risk-scoring approach to help you synthesize critical organization-specific information along with public vulnerability intelligence to provide customized accurate risk scoring. Leverage CVRS to bring in asset context, exploitability information, and the latest updates, to your risk assessment.

Cortex Vulnerability Risk Scores range from 0 to 100, with 100 representing the highest risk. Scores are updated on a daily basis or whenever a findings revision takes place. They are included on vulnerability findings and issues to enable efficient sorting and filtering of vulnerabilities based on risk. Find more details about the risk factors that determine each score on the issue details panel.

Use CVRS to quickly analyze, report, and remediate the highest-priority issues. In addition, CVRS helps you inform and align your team, so you can focus on the most critical issues.

## **CVRS Assessment Framework**

Cortex XSIAM uses the following factors to determine the CVRS.

<table><thead><tr><th width="209">Risk factor</th><th>Description</th></tr></thead><tbody><tr><td>Vulnerability Context</td><td>Uses the CVSS base score</td></tr><tr><td>Exploit Intelligence</td><td>Uses EPSS, CISA KEV, exploited in-the-wild, and exploit maturity data</td></tr><tr><td>Asset Risk</td><td>Evaluates public internet-exposed assets</td></tr><tr><td>Environment Risk</td><td>Leverages Attack Surface testing results to determine whether an asset is a package-in-use</td></tr><tr><td>Compensating Controls</td><td>Accounts for assets with Compensating Controls (requires Exposure Management add-on)</td></tr></tbody></table>

## **View Cortex Vulnerability Risk Score**

The CVRS is displayed in the Vulnerability Issues table, and CVRS details are included in the issue details.

1. Navigate to **Home > Modules > Vulnerability & Exposure Management > Vulnerability Issues**.

   The Cortex Vulnerability Risk Score appears in the **CVRS** column in the table.
2. Click on a row in the table to open the details panel.

   The **Overview** tab includes the vulnerability risk score, and the **Evidence** section includes a high-level summary of the evidence used to determine that score.

   The **Risk Details** tab provides details about each risk factor that Cortex XSIAM uses to determine the risk score.

You can also find the Cortex Vulnerability Risk Score and high-level risk score evidence on Vulnerability Findings.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/cortex-vulnerability-risk-score.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.