# Vulnerability Prioritization: An Offensive Security Approach

arXiv: https://arxiv.org/abs/2206.11182 · HTML: https://mlsanity.com/paper/2206.11182/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 11 references that are in the map.
- First posted on arXiv 22 Jun 2022.

## Builds on (most cited first, 2 of 2)

- [Exploit Prediction Scoring System (EPSS)](https://mlsanity.com/paper/1908.04856/) (2019)
- [Towards an open standard for assessing the severity of robot security vulnerabilities, the Robot Vulnerability Scoring System (RVSS)](https://mlsanity.com/paper/1807.10357/) (2018)

## Built on by (most cited first, 1 of 1)

- [TIPS: Threat Actor Informed Prioritization of Applications using SecEncoder](https://mlsanity.com/paper/2411.07519/) (2024)

## Abstract (arXiv)

Organizations struggle to handle sheer number of vulnerabilities in their cloud environments. The de facto methodology used for prioritizing vulnerabilities is to use Common Vulnerability Scoring System (CVSS). However, CVSS has inherent limitations that makes it not ideal for prioritization. In this work, we propose a new way of prioritizing vulnerabilities. Our approach is inspired by how offensive security practitioners perform penetration testing. We evaluate our approach with a real world case study for a large client, and the accuracy of machine learning to automate the process end to end.