How it works
Risk and priority
CVSS alone says how bad a vulnerability could be. It does not say whether anyone exploits it, or whether the vulnerable software on your host can be reached at all. The SEK Systems score combines all three, so that the Act now list contains what really needs attention.
The score
score = base × exploitation × NCSC × briefing × exposure × crown jewel (rounded, at most 100)
Base
The CVSS base score × 10 (so CVSS 9.8 gives 98). Without a CVSS score, the urgency the distribution assigned: critical 90, high/important 75, medium/moderate 55, low 35, negligible 15, otherwise 50.
Exploitation
Only the strongest signal counts:
| Signal | Factor |
|---|---|
| On the CISA KEV list (known exploited), or SSVC exploitation "active" | × 2.0 |
| EPSS percentile 95 or higher | × 1.6 |
| EPSS percentile 80 or higher | × 1.3 |
| SSVC exploitation "proof of concept" (a public exploit exists) | × 1.15 |
NCSC and threat briefings
- An NCSC-NL advisory with both likelihood and impact high: × 1.25; one of the two: × 1.1.
- An urgent threat briefing that says to prioritise patching: × 1.2 (not on top of KEV).
Exposure (L × R)
Exposure has two parts. L (local) says whether the vulnerable software is used at all, R (reach) says who can reach it over the network.
| L | Means | Factor |
|---|---|---|
| L0 | Installed, but not used by any running process | × 0.4 |
| L1 | Loaded by a running process (for example a library) | × 0.8 |
| L2 | Listens, but only on loopback | × 0.9 |
| L3 | Listens on the network | depends on R |
For L3, the factor depends on R:
| R | Means | Factor |
|---|---|---|
| R0 | Blocked by the host firewall | × 0.6 |
| R1 | Internal only | × 1.0 |
| R? | Unknown | × 1.1 |
| R2 | Reachable from specific public sources only | × 1.2 |
| R3* | Likely reachable from the internet (not measured) | × 1.5 |
| R3 | Measured reachable from the internet | × 1.8 |
How R is determined, with the evidence per service, is on Attack surface and in External and internal probes.
Crown jewels
A host tagged as crown jewel (tag crown_jewel): × 1.3.
Buckets
| Bucket | Rule | Default deadline |
|---|---|---|
| Act now | score ≥ 80, or known exploited (KEV or SSVC active) and listening on the network (L3) and not blocked by the host firewall or internal only (not R0 or R1) | 14 days |
| This week | score 60 to 79 | 30 days |
| Planned | score 30 to 59 | 90 days |
| Watch | score below 30 | none |
A known exploited finding (KEV or SSVC active) gets a deadline of 7 days, whatever its bucket.
The second rule for Act now makes sure a known exploited vulnerability in a reachable service is never buried because its CVSS is modest.
Examples
| Situation | Calculation | Score | Bucket |
|---|---|---|---|
| CVSS 9.8, no exploitation known, library loaded (L1) | 98 × 0.8 | 78 | This week |
| CVSS 7.5, on KEV, web server measured reachable (L3·R3) | 75 × 2.0 × 1.8 = 270 | 100 | Act now |
| CVSS 7.5, on KEV, service blocked by the host firewall (L3·R0) | 75 × 2.0 × 0.6 | 90 | Act now (score ≥ 80) |
| CVSS 9.8, installed but unused (L0) | 98 × 0.4 | 39 | Planned |
| CVSS 5.3, EPSS percentile 97, internal only (L3·R1) | 53 × 1.6 × 1.0 | 85 | Act now |
Every finding explains its own calculation under Why <score>? on the finding detail.
Host risk level
Each host also gets a level, shown on the Overview and in the Agents list:
| Level | When |
|---|---|
| critical | an exploitable vulnerability reachable from the internet, or an urgent attack path |
| high | a known exploited vulnerability, an exploitable vulnerability in software that listens on the network, or an open attack path |
| medium | a public exploit or a high chance of exploitation, or a vulnerability that should be fixed now |
| low | everything else |
Hardening score
Configuration checks have their own hardening score, which measures configuration only and does not include vulnerabilities. See Hardening.