Critical CVE ≠ your breach risk

Someone drops a Critical into Slack. The ticket template fills itself in. The queue grows. Leadership asks why the backlog never shrinks. Meanwhile the thing most likely to get you breached sits at Moderate because the CVE card said so — and nobody asked whether an attacker could actually use it from the internet.

That is the trap: treating vendor severity as your breach risk.

What CVSS is good at

CVSS (Common Vulnerability Scoring System) is a shared language for how bad a vulnerability can be in the abstract — how severe the flaw is when you assume a typical exploitation story. Security teams need that. Patch vendors need that. Incident response needs a way to say "this class of bug is nasty."

What CVSS does not know:

• Whether your asset is reachable from an attacker who matters
• Whether the vulnerable component is actually in the path to something valuable
• Whether compensating controls already kill the exploit in practice
• How this finding compares to other real intrusion paths on your perimeter today

So a CVSS 9.8 on an internal lab box and a CVSS 6.5 on an internet-facing login path are not "the same priority with different labels." They are different risk problems. The scorecard on the CVE does not know your architecture.

Organizational breach risk is a different question

Breach risk asks: given what we expose and how attackers work, how likely are we to get breached — and how bad if we do?

That question cares about reachability, exploitability, and consequence for this organization. A continuous outside-in assessment that emulates attackers and verifies paths will sometimes elevate a "medium" that sits on a live door, and deprioritize a "critical" that isn't in play. That isn't softness. It's honesty.

What goes wrong when Critical runs the program

1. Infinite queues — every Critical must be first, so nothing is first.
2. Missed doors — reachable, verified paths with lower CVSS wait behind theater.
3. Board confusion — "we patched 40 Criticals" sounds like progress while exposure didn't move.
4. False calm — a week with no Critical CVEs is not the same as a week with no breach paths.

A better default rule

Use CVE/CVSS (and related signals) as context on a finding — not as the master sort for the company. Sort first by: is this a path an attacker can use against us, have we verified that, and what happens if they succeed?

That is the difference between managing a vulnerability catalog and managing breach risk. The BreachRisk Score exists to keep the second question in front — rolled up from tested surface and verified exposure, not averaged from CVE severities.

Critical still matters. It just isn't the same word as us.