Cybatar Security Hub
Trust Center·Company facts
Security Hub
Menu
Platform Solutions Pricing Industries Use cases Resources Trust Center Company Contact
Client login Start free trial
Exposure Management / Methodology
Editorial & technical methodology

Cybatar Exposure Management & Vulnerability Prioritisation Methodology

How Cybatar separates technical severity, exploitation evidence, exploit probability, asset exposure, business consequence, treatment and remediation validation.

Published 2026-08-17Reviewed 2026-08-17

Method principles

Principle 1

Start from the affected asset and business service, not from a severity number in isolation.

Principle 2

Keep known exploitation, exploit probability and technical severity as separate signals with separate meanings.

Principle 3

Treat CISA KEV as strong evidence of exploitation in the wild, while still confirming whether the vulnerable product/version affects the organisation.

Principle 4

Treat EPSS as a time-sensitive exploitation-probability signal, not a complete risk score or asset-specific prediction.

Principle 5

Use CVSS to communicate vulnerability characteristics and severity; add threat and environmental context rather than publishing Base score alone as risk.

Principle 6

Record prioritisation decisions with score/source dates, asset context, owner, treatment and exception rationale so the decision can be reviewed later.

Principle 7

Treat remediation as incomplete until the intended change is implemented and the affected scope is validated.

Principle 8

Keep residual exposure, failed/deferred assets and compensating controls visible instead of hiding them behind a closed ticket.

External source notes

CISA Known Exploited Vulnerabilities CatalogUsed for observed exploitation in the wild and CISA’s recommendation to use KEV as a prioritisation input.FIRST EPSSUsed for 30-day exploitation-probability concepts and explicit limitations that EPSS is not a complete risk score.FIRST CVSS v4.0Used for Base, Threat, Environmental and Supplemental vulnerability-severity concepts.NIST SP 800-40 Rev. 4Used for enterprise patch-management planning, prioritisation and verification concepts.

Explicit non-claims

  • Cybatar does not guarantee discovery of every vulnerability or asset.
  • KEV absence does not mean a vulnerability is safe or irrelevant.
  • EPSS does not predict whether a specific asset will be exploited and is not a complete risk score.
  • CVSS is not by itself a complete organisational risk score.
  • Cybatar does not claim FIRST, CISA or NIST certification or endorsement.
  • A closed remediation item or passing validation check does not prove the environment is secure.

How to use this methodology

Start with affected assets and business consequence, add observed exploitation and exploit-probability evidence, interpret technical severity in context, assign accountable treatment, then validate closure. Preserve the source and date of time-sensitive signals so later reviewers can understand why the priority changed.