# RiskBridge: Turning CVEs into Business-Aligned Patch Priorities

arXiv: https://arxiv.org/abs/2601.06201 · HTML: https://mlsanity.com/paper/2601.06201/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 36 references that are in the map.
- First posted on arXiv 8 Jan 2026.

## Builds on (most cited first, 9 of 9)

- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [Large Language Models for Cyber Security: A Systematic Literature Review](https://mlsanity.com/paper/2405.04760/) (2024)
- [LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights](https://mlsanity.com/paper/2502.07049/) (2025)
- [Exploit Prediction Scoring System (EPSS)](https://mlsanity.com/paper/1908.04856/) (2019)
- [Economic Factors of Vulnerability Trade and Exploitation](https://mlsanity.com/paper/1708.04866/) (2017)
- [A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges](https://mlsanity.com/paper/2502.11070/) (2025)
- [VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs](https://mlsanity.com/paper/2502.11143/) (2025)
- [Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems](https://mlsanity.com/paper/2508.13644/) (2025)
- [Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization](https://mlsanity.com/paper/2506.01220/) (2025)

## Abstract (arXiv)

Enterprises are confronted with an unprecedented escalation in cybersecurity vulnerabilities, with thousands of new CVEs disclosed each month. Conventional prioritization frameworks such as CVSS offer static severity metrics that fail to account for exploit probability, compliance urgency, and operational impact, resulting in inefficient and delayed remediation. This paper introduces RiskBridge, an explainable and compliance-aware vulnerability management framework that integrates multi-source intelligence from CVSS v4, EPSS, and CISA KEV to produce dynamic, business -- aligned patch priorities. RiskBridge employs a probabilistic Zero-Day Exposure Simulation (ZDES) model to forecast near-term exploit likelihood, a Policy-as-Code Engine to translate regulatory mandates (e.g., PCI DSS, NIST SP 800-53) into automated SLA logic, and an ROI-driven Optimizer to maximize cumulative risk reduction per remediation effort. Experimental evaluations using live CVE datasets demonstrate an 88% reduction in residual risk, an 18-day improvement in SLA compliance, and a 35% increase in remediation efficiency compared to state-of-the-art commercial baselines. These findings validate RiskBridge as a practical and auditable decision-intelligence system that unifies probabilistic modeling, compliance reasoning, and optimization analytics. The framework represents a step toward automated, explainable, and business-centric vulnerability management in modern enterprise environments