Fifty-six % of the vulnerabilities in our monitored population were rated critical or high.
That is a wall of red across 276k Common Vulnerabilities and Exposures (CVEs). As guidance to a remediation team, it is almost useless. It tells them everything is urgent, which is the same as telling them nothing is.
The average organisation carries 1,066 known vulnerabilities. Around thirteen % are remediated. The average time to patch is 271 days. These numbers describe a system with more demand than capacity, and no reliable way to decide what should be fixed first.
That is the problem Kaze exists to solve: helping organisations turn complex, fast-moving information into confident action.
Designating the main effort
In military planning, a commander who declares every task to be the main effort has, in practice, declared that there is no main effort. The phrase exists because resources are finite, and someone has to say, clearly and explicitly, which objective gets the reserve. The discipline is not in identifying what matters. Everything on the list matters, or it would not be on the list. The discipline is in deciding what gets resourced first.
Traditional vulnerability scoring asks the opposite of its users. It scores each vulnerability largely on its own terms, with limited reference to what else is competing for the same remediation capacity. A hundred criticals and one critical can produce the same instruction: fix this now.
Worse, it scores them once.
Intelligence changes dynamically. The assessment should too.
A target list is dynamic. It is reviewed as the intelligence picture develops, and priorities move when something new is learned. A list compiled in March and never revisited is not a plan; it is an artefact.
The Common Vulnerability Scoring System (CVSS) is set at publication and rarely revisited. The National Vulnerability Database (NVD) has carried a backlog of more than 17,000 CVEs awaiting a score. Meanwhile, the threat landscape evolves daily and operational relevance changes overnight.
The NVD assessed it at 4.4, Medium, in March 2023. On 11 April 2023, Microsoft confirmed it as the vulnerability underpinning the BlackLotus Unified Extensible Firmware Interface (UEFI) bootkit campaign. Two years on, the published score still reads 4.4.
Nothing about the vulnerability changed; the context changed dramatically. Remediation teams referring to the published list in good faith have had no reason to prioritise it.
Why the scores bunch at the top
There is a second, quieter failure. CVSS categories are broad and human-scored, and human scorers under uncertainty round upwards. Nobody is ever criticised for over-rating a vulnerability that turns out to be benign. The incentive runs one way, and the distribution compresses toward the top of the range as a result.
Genuine emergencies become indistinguishable from routine patching, not because the scoring system is wrong in any individual case, but because it has no mechanism for relative ranking.
Only four to five % of known vulnerabilities are ever actively exploited. Treating every high score as urgent does not make an organisation safer. It consumes the finite capacity needed to deal with the small proportion that present real, current risk.
What we changed
As part of a project with a government team, Kaze Consulting produced V-Score. Our scoring methodology was published last year in the Journal of Cyber Security, and now available through KATO Vantage. It reflects the same decision-engineering principle behind KATO AI: collect and structure complex signals, make the reasoning explainable, and give operators a defensible basis for action.
The first layer creates a global score for each CVE. It combines impact and likelihood signals on a common scale, allowing exploit prediction, real-world exploitation and observed threat discussion to sit alongside CVSS. As the evidence base changes, sources can be added, removed or reweighted.
The second layer makes the score local. It carries that global risk view into the environment where the vulnerability exists, considering whether the affected system is reachable and how critical the asset is to the organisation.
That second layer is where much of the value sits.
A scoring standard can describe generic severity. It cannot know which of your systems matter most, which are exposed, or where a disruption would have the greatest operational impact.
The relative importance of those inputs matters. A useful prioritisation model should not only produce a ranked list; it should also show which signals are driving that ranking. The Tornado chart below explains the sensitivity of the model before we move to the operational results.
Tap the chart to view it full size.
What it produced
Measured against CVSS over six months on the same population, V-Score achieved 75% accuracy in predicting Computer Emergency Response Team (CERT)-flagged risk, compared with 39% for CVSS. Recall of high-risk vulnerabilities rose to 52%, compared with 18%.
Critical and high-priority items fell from 56% of the population to under 3%. Not because the estate had suddenly become safer, but because the system could now distinguish between findings that were severe in theory and vulnerabilities that demanded attention in context.
Remediation rose from 24 to 55 vulnerabilities per week. The team did not grow. The decision system improved.
On BlackLotus, V-Score moved the CVE from low priority to top-priority critical on the day the exploitation was confirmed, because it was watching the signals that changed rather than the one that did not.
From information overload to confident action
This is the same principle that sits behind Kaze’s wider approach to digital transformation and decision engineering. More data does not automatically create better decisions. More signals, more alerts and more scores can overload the people expected to act on them.
KATO Vantage is designed for that reality. As part of the KATO AI platform, it scores and ranks cyber risk using live threat intelligence, exploit evidence and real-world impact, while keeping the reasoning explainable and auditable. It moves teams from information overload to operational prioritisation.
A score tells you how bad something might be. A priority tells you what to do on Sunday night.
They are not the same instrument. Vulnerability Management needs both, but it is the second that turns cyber risk into action.
Make Critical Decisions with Confidence