Why CVSS-driven queues never empty
A queue ordered by CVSS is ordered by theoretical worst case across all possible deployments. Applied to a specific estate, it systematically overweights defects in unreachable code and underweights medium-severity defects that sit on an exposed path with privileged access.
The operational consequence is predictable: the critical queue grows faster than capacity, teams negotiate exceptions in bulk, and the program loses the authority to enforce any deadline at all.
Four inputs that change the ranking
Reordering requires inputs that describe this environment. Exploit intelligence establishes whether weaponization exists. Reachability establishes whether the vulnerable function is loaded and callable in a running workload. Asset criticality establishes consequence. Compensating controls establish current difficulty.
Each input must be traceable. A ranking that cannot be decomposed into its factors will be treated as opinion by the teams asked to act on it.
- Exploit intelligence: public exploit, active campaign, known ransomware usage
- Reachability: package loaded, function called, path exposed to untrusted input
- Criticality: business service tier and data classification of the workload
- Compensating controls: WAF rule, segmentation, authentication requirement, with verification
Reachability changes the numbers dramatically
In container estates, the majority of image-level findings correspond to packages present in the filesystem but never loaded at runtime. Filtering on load and call reachability commonly reduces the actionable set by an order of magnitude, and the reduction is defensible because it is evidence-based.
This is also the fastest way to restore developer trust. A queue that reflects running reality gets fixed; a queue that reflects image contents gets argued about.
Service levels expressed in exposure-days
Replace ticket-age SLAs with exposure-days: the cumulative time a validated, exploitable path remained open on a service above a defined criticality. It aggregates cleanly to executive reporting and it cannot be gamed by closing and reopening tickets.
- Tier 1 services: validated exploitable paths closed or compensated within 7 days
- Tier 2 services: 30 days, with monthly variance review
- Any exception: expiry date, compensating control, and continuous verification
- Reopened exposures counted against the original clock
