Severity alone does not decide it: how business impact shapes remediation priority
Contents
When the same vulnerability is found, its effect on the business differs greatly depending on whether it sits on the company's payment system or on a test environment that is hardly used.
CVSS expresses how severe a vulnerability is, but it does not assess how much that matters to each individual company.
In practice, remediation has to take into account which system the vulnerability was found on, as well as how dangerous the vulnerability itself is.
PentaTrail calls this business importance of each system "business impact (BI)".
The same vulnerability, a different remediation priority
Suppose a vulnerability of the same severity is found both on a system that processes customer payments and on a test environment due to be retired.
Even if the technical danger is the same, a payment system going down directly affects revenue and the service you provide to customers. A test environment that is not in use, on the other hand, may have a comparatively small effect on the business.
That does not mean a test environment is safe, of course. You also need to consider whether it is exposed to the internet and whether it could be used to break into other systems.
Even so, if every vulnerability is ranked by severity alone, the fixes that should really come first get buried.
How dangerous the vulnerability is, and how important the system it was found on is: looking at both is what makes prioritization realistic.
Figure 1: The same vulnerability affects the business differently on a payment system and on a test environment
AI judges the importance of each system
So how is the importance of a system judged?
Traditionally, someone had to register the purpose and importance of every asset. But the more assets there are to manage, the harder it becomes to investigate and enter them all and keep them up to date.
In PentaTrail CTEM, AI makes the initial judgment of importance from information about the system observed from outside.
For example, when things such as the website's screens, the products in use or the services exposed allow a system to be judged customer-facing or to carry important work, it is classified as Important.
When there is not enough to go on, it is not assumed to be unimportant; it is set to Standard.
Business impact is expressed in three levels.
- Important: systems judged to have a large effect on the business
- Standard: systems for which there are not sufficient grounds to judge them important
- Limited: systems the user has confirmed have a small effect on the business
AI assigns only two of these automatically: Important and Standard. Limited is set by users in light of their own circumstances.
Figure 2: How AI judges Important or Standard from observed information
People can review and change the AI's judgment
Information visible from outside cannot fully capture how work is done inside the company or how a system is used.
For example, a site that looks like an ordinary website may in fact be a system used by important business partners. Conversely, a service that looks important may no longer be in use.
For that reason, PentaTrail does not treat the AI's judgment as final.
On the "Business impact" tab of the grouping screen, you can review the judgment for each system and change it to Important, Standard or Limited.
An importance set by a user is not silently overwritten by later AI judgments.
If you want to leave it to AI again, you can choose "Back to AI".
Rather than having AI decide everything, AI makes the initial judgment and users supply the business circumstances that cannot be seen from outside.
Figure 3: The screen for the initial judgment by AI and for review and changes by users
Business impact feeds remediation priority
The business impact you set is reflected in PentaTrail's Threat Exposure Risk (TER).
TER is an indicator for deciding remediation priority by combining technical danger, such as vulnerabilities, with the business importance of the system.
At the same technical danger, the more important the system, the higher the priority.
When you change business impact, TER changes with it. By reviewing the importance of an asset, the person in charge can carry that judgment through to the order of remediation.
Remediating vulnerabilities takes more than mechanically fixing the most dangerous items from the top down.
It means directing limited time and people first to the problems that affect the business most. Business impact is the information that supports that decision.
Figure 4: An example of TER changing with business impact at the same technical danger
With PentaTrail CTEM, AI makes the initial judgment of business impact and users can adjust the importance.
Visualize your attack surface with PentaTrail CTEM/ASM
From discovery to remediation — all powered by the CTEM framework.
