Skip to content

Verification · Threat modeling

Risk prioritization

Orders confirmed weaknesses by exposure, exploit likelihood and impact so fixes start where risk is highest.

Sub-techniques

Decision trees V1063.001

SSVC decisions from exploitation, exposure and impact.
Likelihood scores V1063.002

EPSS for known vulnerabilities.

How to build it

Score exposure from the attack surface inventory.
Combine with likelihood and impact through a fixed decision tree.
Recompute when exposure changes.

Signals in a repository

Vulnerability management dashboards or SECURITY.md response targets.