Context Matters More Than Severity
Practitioners should prioritize findings by security context—exposure, asset role, identity privilege, and threat relevance—not generic severity scores alone such as CVSS in isolation.
Context Matters More Than Severity
What practitioners need to know
Practitioners ask: How do I prioritize vulnerabilities? Why are CVSS scores insufficient?
Severity describes a finding in isolation. Context describes whether it matters in your environment. Mature programs prioritize by context-enriched risk, not raw score sorting.
Industry context
CVSS, scanner ratings, and EPSS provide useful inputs. They do not encode:
- Internet exposure vs isolated segment
- Privileged identity pathways
- Active exploitation in the wild (threat relevance)
- Missing compensating controls
- Business criticality of the affected application
Two identical CVE records can warrant opposite urgency.
Common mistakes
| Mistake | Result |
|---|---|
| "Fix all Critical first" | Neglected reachable medium issues |
| Ignoring asset role | Patches on lab while prod identity exposed |
| No threat enrichment | Miss known-exploited prioritization |
| Duplicate counting | Same issue across five tools = false urgency |
Practical implications
- Normalize findings to entities (assets, identities).
- Enrich with reachability and threat context.
- Rank by explainable risk, document why.
- Revisit when context changes (new exposure, new campaign).
Glossary: Security Context (KID-GLS-0003), Risk (KID-GLS-0004), Exposure (KID-GLS-0007).
Related knowledge
KID-CON-0009— Why Correlation MattersKID-FAQ-0005— What is security context?
Authority references
KID-ARC-0001— canonical entities carrying contextKID-OIN-0001— operational prioritization surfaces