Why not CVSS?
CVSS measures theoretical severity in a controlled lab environment. It does not know whether WordPress is running on 40% of SMB web servers, or that the average small business takes 60+ days to patch a firewall. Our score weights each CVE against the actual software stack of small businesses — not enterprise infrastructure — and factors in real exploitation activity, not just attack vector taxonomy.
Score Components
Each CVE receives a composite score from 0 to 100. Components are additive with caps to prevent single-factor dominance.
FIRST.org exploit prediction score. Best real-world proxy for exploitation likelihood. Log-scaled to handle the heavy tail.
Active exploitation confirmed by CISA. Binary bonus — KEV status is the single strongest signal of imminent SMB risk.
Prevalence of affected product in SMB environments × patch lag × internet-facing flag. Proprietary dataset of 27 tracked products.
Public PoC or functional exploit available. Sources: ExploitDB, GitHub, NVD references. HIGH=10pts, FUNCTIONAL=8, PoC=5.
NETWORK vector +6pts, LOW complexity +3pts, NO privileges required +1pt. Rewards wormable and automated exploitation patterns.
If the CVE appears in confirmed ransomware incidents in our database, +10 points are added to the final score (capped at 100). Ransomware correlation is the single strongest predictor of financial impact for SMBs.
Risk Thresholds
Active exploitation highly probable within 14 days. Immediate patch or mitigation required.
Significant risk to unpatched SMB environments. Patch within current cycle.
Monitor closely. Relevant if product is in your stack.
No immediate action required. Patch in regular maintenance window.
SMB Software Stack Coverage
27 products across 8 categories. Prevalence % represents estimated share of SMBs running each product. Patch lag is the observed median days to apply updates in SMB environments.
Data Sources
CVE metadata, CVSS scores, affected CPEs. Fetched daily.
Exploit Prediction Scoring System. 30-day exploitation probability per CVE.
1,500+ known exploited vulnerabilities. Updated daily. Binary KEV flag.
SMB breach incidents with CVE correlation, ransomware group, financial impact.
Update frequency: CVE scores are recomputed daily. EPSS scores update every 24h from FIRST.org. CISA KEV membership is checked at each pipeline run. SMB Stack prevalence data is reviewed quarterly. SMB Attack Probability Score™ is proprietary to TIRESIS.