Methodology
The Zennoxa Priority Engine
How Zennoxa Shield ranks vulnerabilities by evidence, not severity.
The problem it solves
A scanner that sorts by CVSS hands you a wall of “Criticals,” most of which nothing in your app can trigger. Severity is potential impact in the abstract — it says nothing about whether the vulnerable code is reachable, whether the CVE is being exploited, or how likely it is to be. The Priority Engine answers the question CVSS can’t: what should I fix first?
The pipeline
Every finding flows through four evidence signals into one 0–100 score:
The formula (published, not a black box)
Each input is normalized to 0–100. We publish the exact weights because a prioritization you can’t inspect is just another opaque score. A naive CVSS-heavy weighting was explicitly rejected in our architecture review — severity is one input, not the sort key.
Why each signal
- CVSS 0.30Impact ceiling. Necessary, but over-predicts urgency on its own.
- EPSS 0.30FIRST.org’s public model for exploitation probability. A CVSS 9.8 with EPSS 0.1% is less urgent than a CVSS 7.5 with EPSS 40%.
- KEV 0.25CISA’s public catalog of vulnerabilities confirmed exploited. If it’s on KEV, it jumps the queue — real-world evidence, not a model.
- Reachability 0.15The differentiator. Does untrusted input actually reach the vulnerable sink in your code? An injectable query on a live route outranks a critical CVE in a function nothing calls.
Honest scope of “reachability”
Read this straightReachability here is intra-file taint tracking plus reachability heuristics (does untrusted input reach a sink; is the sink on a live path). It is not full whole-program interprocedural analysis, and we don’t claim it is. It’s enough to float the exploitable bug above the dead-code CVE — the part that matters most for triage — and we publish our precision and false-positive rate next to the ranking so you know how much to trust the order.
Grounded in public evidence
EPSS and KEV are public — you can verify any finding’s inputs yourself. Our own research quantifies why this matters: on public CVE data, the large majority of “Critical” CVEs have low exploitation probability and aren’t on KEV — severity alone is the wrong first question. See the research and the reproducible numbers.
Use it
Zennoxa Shield computes this for every finding, in one offline pass. The signals are public; the weights are above; the code is MIT-licensed. Prioritization you can audit.