All research
Engineering6 min read
Why we rank findings by exploitability, not severity
A generic severity score says how bad a bug could be somewhere. Exploitability says whether it can hurt you here.
By Platform team
Severity scores describe a vulnerability class in the abstract. Two identical SQL injection findings get the same score whether one sits behind an internal admin tool and the other is on your login page.
Opsec replaces that with an exploitability rating computed from what the validation step actually observed: whether the path was reachable, what preconditions it needed and what the replica allowed the attacker to do.
Fewer findings, faster decisions
Teams moving to exploitability-first triage see a shorter queue and fewer debates about priority. When a finding is at the top, it comes with a recorded path that shows why.