CTEM Prioritization Stage: Rank Exposures That Matter

• A scoring model you can copy
• How to weight business impact
• How to use threat intelligence responsibly
• How to keep the list short enough to act on

A simple scoring model

Score each exposure from 1-5 on four factors, then sum:

1. Business impact — what breaks if this is exploited?
2. Exploitability — is there working exploit code or an easy path?
3. Threat activity — is it being used in the wild right now?
4. Control gap — are compensating controls missing?

Attack paths beat single findings

An attacker rarely uses one CVE. They chain a foothold, a credential, and a privilege step. Prioritize the chains that reach crown jewels, even if each link is medium severity.

• Adopt the scoring model above for your first cycle
• Publish the top ten exposures each week
• Include one attack-path finding on every top-N list
• Retire scores older than 30 days without re-review

• Ranking by CVSS only
• Using threat intel that is not relevant to your industry
• Producing a top-100 list nobody will act on
• Ignoring control coverage as a factor