Threat-based prioritization
Remediation order set by the real threat.
A CVSS score measures how technically severe a flaw is, but it doesn't tell you whether the flaw is being exploited or which asset it affects. BeforeTHEM calculates the priority of each vulnerability from the threat observed in the wild and the asset's role on your network, and shows the factors behind every result.
How priority is calculated
Three factors, one priority from 0 to 100.
Every factor comes from collected data and threat intelligence. None of them depends on manual classification, and each finding shows how its priority was built.
How much the flaw is being exploited and how easy it is to exploit.
The impact of a compromise, based on the asset's function on the network.
Whether the flaw can be reached: exposed to the internet, running, or only installed.
From 0 to 100, setting the position in the remediation queue.
Factor 1 · Threat
The signals that make up the threat.
The threat starts from technical severity and is raised by evidence of exploitation. The more concrete the evidence, the higher the flaw climbs on the scale, regardless of its CVSS score.
| Signal | What it indicates | Effect on priority |
|---|---|---|
| Used by ransomware | the flaw appears in known ransomware campaigns | moves the flaw to the top of the scale |
| Confirmed exploitation | the flaw is listed in the CISA KEV catalog, with exploitation recorded in real attacks | places the flaw in the critical band |
| Weaponized exploit | a ready-to-use exploit exists in attack frameworks, according to ThreatSensor intelligence | places the flaw in the critical band |
| Public exploit | exploit code has been published | raises the threat |
| Proof of concept | the exploitation technique is known and reproducible | raises the threat |
| EPSS | probability of exploitation in the next 30 days, updated daily | high percentiles raise the threat, and the highest ones bring it close to the critical band |
| CVSS | technical severity of the flaw | sets the starting point |
ThreatSensor intelligence
When a ready-made exploit exists, priority goes up.
ThreatSensor is the CSURFACE threat intelligence service. It tracks which vulnerabilities already have a weaponized exploit in attack frameworks, and that signal feeds directly into the BeforeTHEM threat calculation. A flaw that can be exploited with an off-the-shelf tool is treated as critical, even when its CVSS score is moderate.
Factor 2 · Asset role
The same flaw weighs more on a domain controller.
Each asset's role is identified automatically from the services it runs, with no manual registration. When an asset has more than one function, the most critical one applies.
Factor 3 · Exposure
- Exposed to the internet. A flaw reachable from outside the company gets additional weight.
- Running or only installed. Software that is installed but stopped weighs less than a running service, and even less than a service listening on the network.
Explainable priority
Every priority shows how it was built.
In each finding's details, the team sees the threat signals, the asset role, and the exposure that set the priority. The decision about what to fix first has a clear rationale, and the conversation with the infrastructure team gets easier.
- Confidence level. Each finding states whether it came from a banner, from the version read on the host, or from an active test.
- Stable severity band. The critical, high, medium, or low band comes from the threat; role and exposure adjust the order within the queue.
Work queue
By asset or by vulnerability.
Infrastructure teams usually organize work by server, while security teams think in vulnerabilities. The queue offers both views of the same data, with filters by site, subnet, asset type, and operating system.
Everything a server needs
Open the host and see its flaws in priority order, along with services, installed software, and history. Useful for planning a maintenance window.
Where a flaw shows up
Open the CVE and see every affected asset. Useful when a new advisory comes out and the question is whether the company is exposed.
See the remediation queue ordered by threat.
In the demo, we compare the same network sorted by CVSS alone and sorted by threat-based prioritization.