Severity & Scoring
How apPosture turns raw findings into a priority order you can trust.
The signals
| Signal | Question it answers | Where it comes from |
|---|---|---|
| Severity / CVSS | How bad is it in principle? | The finding / advisory |
| EPSS | How likely is it to be exploited soon? | EPSS feed |
| KEV | Is it being exploited right now? | CISA KEV feed |
| Reachable | Can it actually be reached in your app? | SCA reachability / SAST flow |
| Exploit confirmed | Did we prove it works here? | DAST proof-of-exploit |
| Business criticality | How much does the affected app matter? | Application setting |
How they combine
No single number tells the whole story. apPosture blends them so that:
- A proven-exploitable issue outranks a theoretical one of equal CVSS.
- A KEV or high-EPSS Medium can outrank a low-EPSS High.
- An unreachable Critical is deprioritised relative to a reachable High.
- Findings on business-critical apps are weighted up.
This is exactly the logic behind the Priorities funnel:
All → Reachable → Exploitable → KEV
The posture score (0-100, A-F)
The org posture score is deterministic: it starts at 100 and subtracts capped penalties, so the same inputs always produce the same grade.
| Penalty | Per | Cap |
|---|---|---|
| Open critical vulnerabilities | -8 each | -40 |
| Exploit-confirmed vulnerabilities | -12 each | -40 |
| SLA-breached vulnerabilities | -5 each | -25 |
| Open high vulnerabilities | -2 each | -15 |
| MTTR > 30 days | -10 (or -5 above 14 days) | - |
The remaining number maps to a grade: A ≥ 90 · B ≥ 80 · C ≥ 70 · D ≥ 55 · F < 55.
The heaviest weight sits on exploit-confirmed and open-critical issues - the score cannot be gamed by clearing low-severity noise while proven-exploitable risk sits open. (The Kubernetes cluster grade uses a separate control-pass ratio with its own bands - D ≥ 60 · F < 60.)
Why CVSS alone isn't enough
CVSS measures intrinsic severity, not real-world risk to you. A CVSS 9.8 in dead code you never call is lower real risk than a CVSS 6.5 that's reachable, internet-facing and on the KEV list. apPosture's scoring exists to close that gap.
When in doubt about what to fix first, work the Priorities funnel bottom-up (KEV → exploitable → reachable). It already encodes the combination logic above.