Priority-Score
Priority Score
Priorisierungs-Score
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
History & facts. With the sheer volume of vulnerabilities, it became clear that no single metric suffices: CVSS measures severity, EPSS measures likelihood, the KEV catalogue marks demonstrably exploited flaws, and only one's own context decides whether an asset is exposed and worth protecting at all. A priority score brings these dimensions together by rule rather than leaving them side by side — so an actively exploited flaw on an exposed system rises to the top, while a theoretically critical flaw without exposure recedes.
Outlook & recommendation. The exact weighting is no law of nature but a deliberate decision that must fit the risk posture of the respective organisation. What matters is transparency: a good priority score is explainable, not just an opaque number. In the NEOSEC Intel platform (neosec.eu) it serves to lift, out of the flood of reports, the few cases that deserve attention today — the operationalisation of what CVSS and EPSS each only half answer.