Zennoxa Shield
Application Security Glossary

Priority Engine

The Priority Engine is Zennoxa Shield's risk-scoring approach that combines four public signals into a single 0-100 score using the formula CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, so developers can rank findings by real risk rather than raw severity alone.

The Priority Engine is Zennoxa Shield's method for turning multiple independent risk signals into one comparable score from 0 to 100. Rather than ranking vulnerabilities by severity alone, it blends four established inputs: CVSS for intrinsic severity, EPSS for the probability of near-term exploitation, CISA KEV status for confirmed real-world exploitation, and reachability for whether the vulnerable code is actually invoked in your application.

Each signal is normalized and weighted: CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15. Severity and exploit-likelihood carry equal, substantial weight; confirmed exploitation (KEV) adds a strong evidence-based boost; and reachability refines the score with code context so present-but-unreachable flaws rank lower. The result is a ranking that reflects both how dangerous a flaw is and how likely it is to matter to you.

For developers, the value is focus. A backlog sorted purely by CVSS treats every Critical the same, but a KEV-listed, high-EPSS, reachable vulnerability is a very different obligation from a Critical that is unproven and unreachable. The Priority Engine surfaces the former first, so limited remediation time goes to the findings that carry genuine risk.

Frequently asked questions

What is the Priority Engine?
The Priority Engine is Zennoxa Shield's risk-scoring approach that merges CVSS severity, EPSS exploit probability, CISA KEV exploitation status, and code reachability into a single 0-100 priority score to rank findings by real risk.
How is the Priority Engine score calculated?
It normalizes and weights four signals with the formula CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, producing a 0-100 score that reflects severity, likelihood of exploitation, confirmed exploitation, and whether the code is reachable.
Why not just prioritize by CVSS severity?
CVSS measures how damaging a flaw could be but ignores whether it is being exploited or is even reachable in your app. Blending in EPSS, KEV, and reachability separates urgent, exploitable findings from theoretical ones.

Related terms

Priority Engine — Zennoxa Glossary — Zennoxa Shield