Prioritizing vulnerabilities using the Concert risk score

Edit online

Prioritize CVEs by using the Concert risk score, which reflects severity, exploitability, and environmental context. This score helps identify which vulnerabilities require attention first based on how they affect your applications and environments.

For example, an application security engineer supporting a retail checkout platform might see several CVEs with similar CVSS scores across customer-facing and internal application versions. Instead of relying only on CVSS severity, the engineer can use the Concert risk score, priority, application version context, remediation status, fix availability, and blast radius to identify which CVEs create the greatest risk in the current environment. This helps the team investigate vulnerabilities that affect business-critical or externally exposed applications before lower-impact findings.

About this task

Draft comment:
Hey @Seymone - Is there any specific pre-reqs for executing this task for the user? If yes, can you please let me know
The Concert risk score provides a contextual assessment of the potential impact of a vulnerability within your environment. Instead of using only the CVSS score, Concert uses the following components to calculate the risk score:
  • Severity: Measures the technical severity of the CVE based on the CVSS score.
  • Exploitability: Measures the likelihood that the CVE can be exploited.
  • Environmental factors: Measures risk in your environment, including application criticality, data sensitivity, and network exposure.

The Concert risk score is calculated as: Severity (CVSS) × Exploitability (EPSS) × Environmental Factor, normalized to a 10-point scale.

Based on the risk score, Concert assigns a priority level to each CVE finding. This priority helps you focus remediation efforts on the vulnerabilities that pose the greatest risk in your environment.

Procedure

  1. Go to Protect > Dimension > Vulnerability.
  2. On the CVEs tab, use the page filters to narrow the vulnerability data by application and deployment context. You can filter by:
    • Application versions
    • Application version tags
    • Deployments
    • Deployment tags
  3. Review the summary cards at the top of the page:
    • Priority breakdown: Shows findings by Priority 1, Priority 2, Priority 3, and Deprioritized.
    • Vulnerabilities: Shows the number of unique CVEs, total findings, and overdue findings.
    • Fix availability: Shows the percentage of findings that have a fix available.
  4. In the Vulnerability findings section, select Application CVEs or Host CVEs.
  5. In the filter panel, expand Priority and select the priority that you want to review. For example, select Priority 1 to review the highest-priority CVEs.

    You can also filter by Severity (CVSS), Overdue, Upcoming deadlines, Finding age, and Remediation status.

  6. In the vulnerability findings table, review the prioritized list of CVEs. For each finding, you can review information such as:
    • Found in
    • Package
    • CVE
    • Fixed in
    • Age (days)
    • Priority
    • CVSS score
    • Risk score
    • Environmental factor
    • Scan sources
    • Scan type
    • Application
    • Assessment state
  7. Expand a CVE finding row to review additional finding details, such as:
    • Recommended mitigation strategy
    • Digest
    • Package path
  8. Click a CVE ID to view more details about the vulnerability.
  9. On the CVE details page, review the available tabs:
    • Overview: Review the severity, CVSS score, exploitability factor, CVE details, detailed attack vector explanation, and active exploit and remediation information.
    • Applications impacted: Review the application versions that are affected by the CVE.
    • Blast radius: Review how the CVE is connected to affected packages, build artifacts, applications, and environments.
  10. Optional: To adjust how CVEs are prioritized, go to Administration > Settings > Vulnerability priorities . You can configure:
    • Whether to use the Concert risk score, CVSS score, or an external score for prioritization.
    • The risk score ranges for each priority level.
    • Application-specific criticality and data sensitivity values that affect the environmental factor.

Results

You have a prioritized view of CVEs based on risk score, priority, application and deployment context, remediation status, and fix availability. This view helps you identify which CVEs require investigation first and understand how application and environment context affects vulnerability risk.

The same CVE might have different risk levels across different applications or environments, depending on the environmental factors that apply to each finding.

What to do next

After prioritizing CVEs, you can:
  • Investigate high-priority CVEs to understand their impact and available remediation options.
  • Compare findings across environments to understand how the same CVE is prioritized in different contexts.
  • Generate AI-powered remediation guidance for high-priority vulnerabilities.
  • Create tickets in your external issue tracking system to address prioritized CVEs.