Compute-Budgeted Exploitability

Every week your security lead decides which of several hundred newly disclosed vulnerabilities gets remediated first, and most of the tooling built to support that decision hands back a number with nothing attached to it. A score of 0.87, whatever it was derived from, cannot be re-derived, challenged item by item, or shown to an insurer as anything stronger than an assertion. What closes the distance between a score and a decision anyone can defend is a receipt attached to the number that names the dated public signals behind it.

The volume of disclosure outran what any team can patch promptly a long time ago, and the signals that separate the urgent from the merely severe sit scattered across advisories, exploit archives, fix commits, and community discourse, every one of them timestamped and arriving on its own schedule. The security lead was never the weak point in that chain. Enterprise risk functions already have the vocabulary for what is missing here: a number that cannot be traced back to its inputs does not survive a review meeting, and a model whose drivers cannot be named does not survive an examiner.

01What an Auditable Score Actually Contains

One recent evaluation carried that standard into vulnerability triage across 12,012 prospectively scored vulnerabilities. The rule underneath it is narrow and severe. For each vulnerability, the score admits only public evidence visible by a fixed decision time, so nothing generated after the exploitation event can quietly inform the number that was supposed to anticipate it.

The artifact that rule produces is short enough to lay out row by row.

The structure of the support becomes as visible as its size. A score resting on an official advisory and an independent community disclosure thread that corroborate each other is a stronger claim than a score resting on four items pulled from a single channel, and the certificate puts that difference on the face of the number where a reviewer will see it. That also means a certificate resting on one channel is a score to hold loosely, because it is indistinguishable from a score built on a single source that happened to be wrong.

02Prioritization Discipline That Fits the Budget

The economics decide whether any of this reaches a business with no analyst to spare, and here the economics are unusually friendly. Budgeted evidence selection raised leakage-safe prospective recall@50 from 0.010 for a severity-only baseline to 0.026, a 150% relative gain, and a budget of only 2 evidence documents per vulnerability captured most of that value, so the triage stays cheap. Two documents per item is a working constraint an under-resourced team can live inside, bounding both the inference cost and the size of the certificate a human has to read.

One caveat travels with those recall figures.

Those recall numbers come from a sample whose positive base rate is enriched relative to the full disclosure stream, so they are meant to be read comparatively across settings rather than as deployment estimates. In this setup, the ordering is the result; the raw hit rate is not a forecast of what a given environment will see.

The output an operator can act on is an ordered remediation plan where each position carries its own justification. That is what an insurer or a client is asking for when they ask why the third item was patched before the first. None of this replaces the controls underneath it. Patching cadence, managed detection and response, identity hygiene, and tested backups do the heavy work, and for a business without dedicated security staff the honest default for all of them is a managed program. Prioritization discipline sits on top of that foundation and answers a narrower question: where the next hour of remediation effort should go.

03Where Heavier Compute Scored Worse

The instinct when a ranking underperforms is to put a bigger model behind it, and that instinct has now been priced. Adding a strong cross-encoder reranker lowered prospective recall@50 to 0.016 from 0.026, because ranking evidence by query-passage relevance surfaces advisory restatements of the vulnerability description. Those restatements read as highly relevant to the vulnerability and carry no information about whether anyone is attacking it, so the heavier stage paid for a worse ordering.

The buying lesson runs past this one pipeline.

The general lesson for anyone buying security tooling is in the measurement question itself. A large model behind the product says little about whether it improves outcomes for a team of three, and the number of stages in the pipeline says less. The test that survives contact with a real budget is whether the tool measurably changes what gets fixed first and whether it can explain, in terms a reviewer can check, why that order is the right one.

04Ask How the Number Was Measured

The most useful result here is about measurement, and it belongs in the hands of whoever reads the vendor deck.

The test that survives contact with a real budget is whether the tool measurably changes what gets fixed first and whether it can explain, in terms a reviewer can check, why that order is the right one.

Two requests do most of the work in that review.

The standard worth holding is narrow and hard to fake. A risk score earns an operator's action when the evidence behind it and the dates on that evidence are open to inspection, along with the protocol used to measure it, and when a reviewer can rebuild the ranking from the listed signals alone. That is a demand any buyer can make of a vendor and any team can make of its own tooling, and on the numbers here it costs about two documents per vulnerability to satisfy.