Simple explanation
A scan can return thousands of findings — prioritization is what turns that flood into an actual, workable to-do list, focused on what genuinely matters most first.
Technical explanation
- CVSS interpretation — understanding not just the single 0-10 number, but the underlying metrics (attack vector, complexity, privileges required, user interaction, scope, and impact to confidentiality/integrity/availability) that produced it, since two vulnerabilities with the same score can have very different real-world risk profiles.
- Validation: true positive (a real finding), false positive (flagged incorrectly, not actually a vulnerability), true negative (correctly found nothing), false negative (a real vulnerability the scan missed entirely — the most dangerous outcome, since it creates false confidence).
- Context awareness — the same CVE matters far more on an internet-facing production system than an isolated internal test box; raw severity alone doesn't capture this.
- Exploitability / weaponization — whether a working exploit actually exists and is being used in the wild dramatically changes real-world urgency, regardless of the base CVSS score.
- Asset value — a vulnerability on a business-critical system deserves faster attention than the identical flaw on a low-value asset.
- Zero-day — by definition has no available patch, changing prioritization from "when do we patch" to "what compensating control do we apply right now."
Synonyms / related terms
| Term | Means | |---|---| | CVSS | Common Vulnerability Scoring System | | False positive | Incorrectly flagged finding | | False negative | A real vulnerability the scan missed |
Concept Check
"A scan flags a critical CVSS 9.8 vulnerability on an isolated, air-gapped lab system with no network connectivity, and a separate CVSS 9.8 vulnerability on the internet-facing customer login page." Despite identical CVSS scores, the login page vulnerability should be prioritized far higher — context awareness and exposure matter as much as the raw score, and the air-gapped system's practical exploitability is close to zero regardless of its technical severity rating.
Interview-style Q&A
Q: Why is a false negative considered worse than a false positive in vulnerability management? A: "A false positive wastes time investigating something that turns out to be nothing — annoying, but low risk. A false negative means a real vulnerability exists and the team believes, incorrectly, that it doesn't — that's a live, unaddressed risk sitting under a false sense of security, which is strictly more dangerous than knowing you have unresolved findings to work through."
Memory trick
"Score, Confirm, Context, Exploit, Value" — the five inputs to real prioritization, beyond just reading the CVSS number off the report.