Severity & Scoring
Effective prioritization requires more than raw scanner severity. Cloudaware combines vendor severity, CVSS scores, exploitability, and business impact to produce risk scores that drive queues, dashboards, and SLAs.
This guide explains how those inputs are combined to support consistent vulnerability scoring and prioritization in Cloudaware.
Vendor Severity and CVSS
Most scanners provide:
- A qualitative severity (Critical/High/Medium/Low).
- CVSS base scores and vectors for CVE‑based findings.
Cloudaware stores these values on the Cloudaware Vulnerability Scan record so you can:
- Filter by vendor severity across sources.
- Slice by CVSS ranges (e.g., ≥ 9.0).
- Compare vendor‑specific severities side by side.
Business Impact Overlays
Cloudaware overlays scanner data with CMDB context, including:
- Asset criticality – how important the underlying asset is to the business.
- Data sensitivity – whether the asset handles regulated or sensitive data.
- Exposure – internet‑facing vs internal, production vs non‑production, etc.
These attributes typically live on related asset or application records and are referenced when computing risk.
Exploitability and Temporal Factors
Where available, Cloudaware can incorporate:
- Known exploited status (e.g., from KEV lists).
- Availability of public exploits or active campaigns.
- Age of the vulnerability on the asset (“vulnerability age”).
These signals help focus attention on issues that are both severe and actively exploited.
Risk Models
Risk models combine these inputs into a single numeric or categorical score that you can use to:
- Drive sort order in work queues.
- Define SLAs by risk band.
- Build dashboards for executives and technical owners.
Examples:
- Weighted score
Risk = 0.5 * CVSS_Base + 0.3 * Asset_Criticality + 0.2 * Exposure_Flag
- Banding
- Map combined scores into bands such as CRITICAL, HIGH, MEDIUM, and LOW.
See Risk Models for guidance on configuring and operationalizing these models in Cloudaware.