Governance · 2026-07-13 · 8 min
Risk-Based Vulnerability Scoring and Remediation SLAs
Severity alone is misleading. A composite score from CVSS, EPSS, exploit signals, asset criticality, and compensating controls drives the tier, the notification path, and an SLA calibrated by exposure.
Severity alone is misleading. A CVSS 9.8 on an internal host nobody can reach is less urgent than a CVSS 7.5 that is being actively exploited on your internet-facing edge. A program that patches by CVSS wastes its best engineers on the wrong findings. Risk-based scoring fixes that by combining technical severity, real-world exploitability, and business impact into one composite score — then letting the score drive the SLA.
The composite risk score
Five signals, weighted, produce one number:
| Signal | Weight | What it captures |
|---|---|---|
| CVSS | 25% | Technical severity (base score) |
| EPSS | 25% | Probability of exploitation in the next 30 days |
| Exploit signals | 20% | Known exploit, CISA KEV listing, malware family |
| Asset criticality | 20% | Tier of asset, data sensitivity, exposure |
| Compensating controls | 10% | WAF, EDR, network segmentation |
risk = 0.25·CVSS + 0.25·EPSS + 0.20·exploit + 0.20·asset_criticality − 0.10·controls
The two signals teams most often ignore — EPSS (is it actually being exploited?) and compensating controls (is it already mitigated?) — are exactly what separate a real emergency from a theoretical one.
Risk tier drives the action
The composite score maps to a tier, and the tier drives the notification path and the SLA clock:
| Tier | Score | Action |
|---|---|---|
| Critical | ≥ 9.0 | Page on-call · ticket · 24h SLA |
| High | 7.0–8.9 | Auto-ticket · owner notify · 7d SLA |
| Medium | 4.0–6.9 | Backlog · 30d SLA · sprint planning |
| Low | < 4.0 | Monthly review · 90d SLA |
SLAs calibrated by exposure
Severity is only half the SLA. Exposure is the other half — internet-facing systems are held to the strictest timelines:
| Severity | Internet-facing | Internal production | Endpoint / workstation |
|---|---|---|---|
| Critical | 24 hours | 72 hours | 7 days |
| High | 7 days | 14 days | 30 days |
| Medium | 30 days | 60 days | 90 days |
| Low | 90 days | 120 days | Next cycle |
Three rules keep it honest: a KEV or 0-day overrides the clock and triggers the emergency patch process; an SLA breach auto-escalates to security leadership at 80% of the window elapsed; and a weekly SLA scorecard is published per business unit.
Where regulated assets bend the model
A pure severity-times-exposure SLA breaks down the moment the asset is a validated manufacturing controller or a fielded medical device, because you often cannot patch it in 24 hours without breaking a regulated, safety-critical system. This is precisely where the composite score earns its keep:
- Asset criticality rises (patient-safety and production impact), and
- Compensating controls carry more weight (segmentation and monitoring may be the only near-term mitigation), so
- The output is a documented, risk-accepted exception with a time-boxed validation-and-patch plan — not a silent missed SLA.
That nuance — a defensible exception backed by compensating controls rather than a patch you cannot safely apply — is covered in depth in patching the factory floor and medical devices.
The path to implement
- Compute a composite score from CVSS + EPSS + exploit + asset criticality + controls.
- Map the score to a tier that sets the notification path and SLA clock.
- Calibrate SLAs by severity and exposure.
- Override the clock for KEV/0-day and auto-escalate at 80% of the window.
- For regulated assets, allow a risk-accepted exception with compensating controls and a validation plan — never a silent miss.
Incipient's GovPilot computes the composite score, enforces the SLA clock, and produces the audit trail regulators expect — the same risk-tiering discipline applied to vulnerabilities.