Severity & Scoring
How apPosture turns raw findings into a priority order you can trust.
The signals
| Signal | Question it answers | Where it comes from |
|---|---|---|
| Severity / CVSS | How bad is it in principle? | The finding / advisory |
| EPSS | How likely is it to be exploited soon? | EPSS feed |
| KEV | Is it being exploited right now? | CISA KEV feed |
| Reachable | Can it actually be reached in your app? | SCA reachability / SAST flow |
| Exploit confirmed | Did we prove it works here? | DAST proof-of-exploit |
| Business criticality | How much does the affected app matter? | Application setting |
How they combine
No single number tells the whole story. apPosture blends them so that:
- A proven-exploitable issue outranks a theoretical one of equal CVSS.
- A KEV or high-EPSS Medium can outrank a low-EPSS High.
- An unreachable Critical is deprioritised relative to a reachable High.
- Findings on business-critical apps are weighted up.
This is exactly the logic behind the Priorities funnel:
All → Reachable → Exploitable → KEV
Why CVSS alone isn't enough
CVSS measures intrinsic severity, not real-world risk to you. A CVSS 9.8 in dead code you never call is lower real risk than a CVSS 6.5 that's reachable, internet-facing and on the KEV list. apPosture's scoring exists to close that gap.
Trust the funnel
When in doubt about what to fix first, work the Priorities funnel bottom-up (KEV → exploitable → reachable). It already encodes the combination logic above.