Priority Engine
The Priority Engine is Zennoxa Shield's risk-scoring approach that combines four public signals into a single 0-100 score using the formula CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, so developers can rank findings by real risk rather than raw severity alone.
The Priority Engine is Zennoxa Shield's method for turning multiple independent risk signals into one comparable score from 0 to 100. Rather than ranking vulnerabilities by severity alone, it blends four established inputs: CVSS for intrinsic severity, EPSS for the probability of near-term exploitation, CISA KEV status for confirmed real-world exploitation, and reachability for whether the vulnerable code is actually invoked in your application.
Each signal is normalized and weighted: CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15. Severity and exploit-likelihood carry equal, substantial weight; confirmed exploitation (KEV) adds a strong evidence-based boost; and reachability refines the score with code context so present-but-unreachable flaws rank lower. The result is a ranking that reflects both how dangerous a flaw is and how likely it is to matter to you.
For developers, the value is focus. A backlog sorted purely by CVSS treats every Critical the same, but a KEV-listed, high-EPSS, reachable vulnerability is a very different obligation from a Critical that is unproven and unreachable. The Priority Engine surfaces the former first, so limited remediation time goes to the findings that carry genuine risk.