Vulnerability Prioritization Technology

Vulnerability Prioritization Technology

Vulnerability prioritization technology (VPT) streamlines the vulnerability analysis and mitigation process by identifying and prioritizing the vulnerabilities that pose the greatest organizational risks. The approach considers the exploitability of a vulnerability, asset or business-criticality, the severity of a vulnerability, and compensating controls in place. VPT supports a risk-based vulnerability management (RBVM) approach, and utilizes telemetry from vulnerability assessment (VA) tools, configuration management databases (CMDBs), and application security testing (AST). 

VPT automation leverages analytics and vulnerability intelligence to reduce the human resource requirements of performing manual RBVM. The rise in security incidents and breaches is pushing organizations to adopt VPT solutions to obtain effective, efficient vulnerability management programs. VPT identifies more pragmatic risks to the organization and helps prioritize actions for vulnerability treatment, whether via remediation (e.g., patching) and/or compensating controls (e.g., IPS and WAF). 

Organizations switch to VPT when they need to prioritize dynamic vulnerabilities, or when predefined, static CVSS scores no longer reflect the real risk to the organization. A low-risk vulnerability today might be a high-risk vulnerability tomorrow because of dynamic changes made by attackers, while the CVSS score remains relatively static. 

Ridge Security VPT support: As part of an integrated VPT, it prioritizes “risks” — defined as the successful exploits of vulnerabilities — and recommends prioritizing the vulnerabilities that cause the greatest risk over others. Using Adversary Cyber Emulation (ACE), it enables organizations to frequently and consistently test their infrastructure, applications, and defenses, finding and mitigating weaknesses, gaps, and operational deficiencies faster.