STEP 2 - Enrich & Prioritize
Stop drowning in CVSS scores.
Start fixing what actually matters.
Your unified inventory may contain hundreds of thousands of findings. CVSS tells you which ones are technically severe. Hackuity tells you which ones are actually dangerous to your organization right now.
The CVSS Limitation
CVSS was never designed for prioritization
Relying on base severity scores creates noise and paralyzes remediation teams. To secure your perimeter, you need dynamic threat context and business intelligence.
~50% of CVEs are rated High or Critical
CVSS alone makes everything a priority which means nothing is.
Context is invisible to CVSS
Internet-facing vs. air-gapped. PCI-DSS scope vs. dev sandbox. CVSS doesn't distinguish.
Threat landscape changes daily
A CVE published 3 years ago can become critical overnight if a weaponized exploit appears.
THE SOLUTION
One score. Three dimensions of risk.
Hackuity correlates inherent technical severity, real-world exploitation signals, and asset context, including business criticality and security posture, to produce an actionable 0–1000 risk index.
OUR TRS FORMULA
Vulnerability Score
Threat Score
Asset Score
TRS
Vulnerability Score
Effective CVSS Score
Determines the baseline raw technical severity of the security flaw. We normalise and map ingestion schemas across all scanners.
Source
Derived from the effective CVSS score, using CVSS v3.1 or v4.0 base metrics and applicable environmental adjustments.
Priority chain
User overrides → Threat intelligence data → Scanner delivery
Env. integration
Asset-level CIA Requirements contribute to the Asset Score, without double-counting in CVSS Environmental metrics.
Non-CVE
Hackuity provides CVSS Base severity for non-CVE findings.
PRIORITIZATION SCALE
Four risk levels. Clear remediation priorities.
We translate mathematical complexity into clear, actionable color codes. No more gray zones or arbitrary labels.
927
TRS
Critical
900 – 1000
Prioritize in current sprint. Exploit available or threat intelligence elevated.
863
TRS
High
700 – 899
Plan remediation. Monitor threat evolution. May escalate rapidly.
563
TRS
Medium
400 – 699
Technically severe but low immediate exploitation risk in your context. Schedule remediation and monitor for threat escalation.
363
TRS
Low
0 – 399
Low risk in your current environment. Accept, track, and revisit at next maintenance cycle.
GLOBAL BENCHMARKS
A universal score. No context needed.
For contexts where asset configurations are unknown or irrelevant, TRS-Raw delivers structural threat severity benchmark scores based purely on vulnerability intelligence.
CVE-Pedia
Full encyclopedia entry per CVE exploitability, maturity, EPSS, CISA KEV, ATT&CK TTPs, all in one place.
Universal benchmark
Compare CVE risk across perimeters, customers, or time without needing asset-level context.
API-accessible
TRS-Raw is exposed via Hackuity's Vulnerability Intelligence API for integration into external workflows.
INTELLIGENCE ENGINE
The data engine powering TRS.
A unified intelligence framework correlating premium threat intelligence, open-source telemetry, and continuous security vendor analysis.
Real exploitability (boolean)
Exploit Maturity (PoC, Weaponized, Public)
Threat Intensity from OSINT feeds
EPSS v5 score (FIRST.org)
CISA KEV status
CVSS temporal score (v3 & v4)
MITRE ATT&CK TTP
NVD status & CWE
CVE-Pedia: full encyclopedia per CVE
TRS-Raw (context-agnostic score)
All SmartEx2 Core capabilities
Mandiant threat intelligence feed
Recorded Future integration
Recorded Future, Mandiant, Threat...
Detailed exploit timelines
Direct exploit links
Hackuity Vuln Intelligence API & MCP server
30+ threat intell signals you can analyse and query
Custom threat intelligence feeds
Automated vulnerability prioritisation
AUTOMATION
Your context changes the score. Automatically.
Dynamic playbooks ingest organizational context and recalculate risk levels based on environment, data scopes, and business exposure automatically, on a scheduled cadence.
IF
Asset tagged production and internet-facing
THEN
Set Exposure = Internet → TRS recalculated on next automated run
IF
CVE added to CISA KEV
THEN
Auto-flag as critical, trigger notification to SOC
IF
Finding severity ≥ High + no patch available
THEN
Override Exploit Maturity to Weaponized
IF
Asset in scope for PCI-DSS perimeter
THEN
Set Confidentiality Requirement = High
Playbooks run automatically, several times a day.
Every attribute change is reflected in TRS at the next scheduled evaluation, no manual recalculation needed.
Full CVSS ENV support
Leverage complete environment variables or overrides directly. Zero lock-in, complete transparent calculation.
WHAT COMES NEXT
You know what to fix. Now, who fixes it, and how fast?
Deciding remediation prioritization is only half the battle. Handing off tickets, tracking execution states, and measuring remediation speed across engineering and operations shouldn't be manual.
THE PROBLEM RAW DATA ALONE CAN'T SOLVE
Priority is clear. Ownership isn't. Security knows the risk. IT doesn't know it's on them.
Each team has a different ITSM. ServiceNow for some, Jira for others. No single workflow.
Ticket created. Never followed up. No visibility on whether the fix was applied.
Discover how Hackuity orchestrates remediation
3
Automate & Orchestrate
STEP 3 ORCHESTRATE & REMEDIATE
Push tickets to your existing ITSM, track MTTR) with dedicated metrics and dashboards, and get closed-loop visibility on whether fixes were actually applied.
COMMON QUESTIONS
TRS: how it works in practice.
Why is TRS multiplicative, not additive?
Additive models tend to skew and distort priorities by stacking minor issues. Multiplicative algorithms isolate distinct risk indicators, ensuring high context weights are required to trigger Critical score alerts.
Enrich & Prioritize
Can we override TRS for our specific context?
Yes. Playbooks let you modify any asset or finding attribute CIA requirements, exposure level, CVSS environmental vector, protection level and TRS recalculates automatically. Your context always takes precedence.
Enrich & Prioritize
Is TRS different from CVSS?
Yes, fundamentally. CVSS measures technical severity independently of your environment and the real threat landscape. TRS multiplies vulnerability severity by live threat intelligence and your specific asset context.
A CVSS 10 on an air-gapped, non-critical system will have a much lower TRS than a CVSS 7 on an internet-facing production server actively targeted by threat actors.
Enrich & Prioritize
Does Hackuity deduplicate non-CVE findings like misconfigurations?
Hackuity provides CVSS Base severity for non-CVE findings via VulnDB. The TRS formula is identical regardless of finding type only the input values differ. CVE or not, the score is calculated and comparable.
Enrich & Prioritize
