When everything is a priority, nothing gets fixed
Your tools found 40,000 issues this week. Four thousand are rated "Critical." Another tool re-ranks them, and now you have a better-sorted list of 40,000 issues.
That is where prioritization runs out of road. Re-ordering a backlog doesn't remove a single exposure. When everything is a priority, teams spend their time debating the list instead of working it, and the risk stays exactly where it was.
Mondoo is focused on the step that actually reduces risk: remediation. But fixing at speed only works if the people involved trust the fix. Security, IT, and engineering teams need to know why a change is happening, what it touches, how it will be made, and what it will achieve.
That context comes from preemptive exposure validation, delivered through Mondoo Risk Dimensions. Every misconfiguration, CVE, and advisory gets one score from 0 to 100, and every score comes with the reasons behind it.
Risk Dimensions: the "why" behind every remediation
Mondoo adjusts each finding's base severity using five Risk Dimensions. Each one can raise or lower the score based on the asset's real context, and each answers a question the person approving or making the fix will ask.
| Risk Dimension | What it tells the team fixing it | How it moves the score | Applies to |
|---|---|---|---|
| Attack surface | How exposed the asset is: internet, internal network, local only, running but not listening, or no attack surface | Internet-facing raises it; local, system, and none lower it | All findings |
| Blast radius | What kind of service the asset provides: database, identity, LLM agent, Kubernetes, keys, or many open connections | High-value targets weigh more; databases strongly raise it | All findings |
| Business priority | How important the asset is to your organization, set by you as business-critical, dev, or test, plus an optional CIA rating | Business-critical raises it; dev lowers it; test significantly lowers it; a CIA rating can only raise it | All findings |
| Exploitability | How likely the vulnerability is to be exploited, combining EPSS probability over the next 30 days with CISA KEV confirmed exploitation | Active exploitation pushes it up; low likelihood pulls it down | Vulnerabilities |
| In the news | Whether the vulnerability is trending in news and on social media | Can only raise it | Vulnerabilities |
The same CVE is not the same risk everywhere. A Medium-severity CVE that is actively exploited often outranks a Critical one with no known exploits. On an internet-facing production database, the case for fixing it today is obvious, and Risk Dimensions spell out that case. On an isolated test VM, they explain just as clearly why it can wait.
Your context, your rules
Context only builds trust if it is right. Attack surface, blast radius, and exploitability are detected automatically, and you can correct any of them. Annotations at the organization, space, or asset level override what Mondoo detects, and cloud tags from AWS, Azure, and GCP work as overrides too. For example, mark a server behind a VPN as local, or tag assets that process payments or PII with the highest CIA rating.
Admins can also tune the weight of each dimension, or turn one off, for the whole organization. The score reflects how your business actually works, so the remediations it drives make sense to the people doing them.
How the score is built
The score is not a ranking for its own sake. It is the starting point for a fix, and every step that produces it stays visible.
- Start with base severity. For CVEs and advisories, Mondoo uses the CVSS score. For misconfigurations, it uses the impact rating of the failed policy check: Critical, High, Medium, or Low.
- Adjust with Risk Dimensions. Attack surface, blast radius, business priority, exploitability, and news coverage can push the score up. Low exposure, dev or test environments, or low exploit likelihood can bring it down.
- Land on one score from 0 to 100. The same scale covers CVEs, advisories, and misconfigurations, so vulnerability and posture work sit in one queue.
- Decide what gets fixed first. When findings tie at the top, Mondoo settles the order for you.
| Score | Severity |
|---|---|
| 90 to 100 | Critical |
| 70 to 89 | High |
| 40 to 69 | Medium |
| 1 to 39 | Low |
| 0 | None |
For example, a finding scored 76 is High.
When two findings both score 100
A tie never stalls the work. Mondoo orders tied findings by:
- Exposure. The finding on more assets goes first, because one fix removes more risk.
- Business priority. Findings on critical assets already rank higher.
- Exploit evidence. KEV status and EPSS likelihood have already lifted the most dangerous findings.
From score to fix: why, what, how, and impact
A score on its own is still just a number. What moves a team from "we should" to "done" is understanding the remediation before it happens. Mondoo connects each score to the work it calls for.
| The question | What Mondoo shows |
|---|---|
| Why fix this? | The Risk Dimensions behind the score: exploit evidence, reachability, blast radius, and business priority |
| What will be remediated? | The finding and every asset in your space where it appears |
| How will it be fixed? | A remediation initiative, such as updating one vulnerable package on every asset that runs it |
| What is the impact? | How much the initiative lowers your overall space risk score, with initiatives ranked by that reduction |
When the asset owner, the change approver, and the engineer all see the same reasons, remediation stops being a negotiation. People understand the change, so they back it.
Preemptive exposure validation, applied to remediation
Preemptive exposure validation is how Mondoo confirms a weakness is a real exposure in your environment before you change anything, and before an attacker tests it for you. That keeps remediation targeted and explainable.
- Is it reachable? Attack surface separates an internet-facing workload from a host with no network path in.
- Is it being used? EPSS and CISA KEV bring live threat intelligence into the score.
- Does it matter here? Blast radius and business priority weigh what sits behind the asset, from customer data to identity systems.
The outcome is fewer, better-justified fixes. Effort goes to exposures that would actually be used against you, and every change arrives with the evidence for making it.
What this means for your team
Mondoo Risk Dimensions provide preemptive exposure validation that turns remediation from a debate into a decision everyone understands.
- Less arguing over the list. One score from 0 to 100 replaces competing CVSS ratings, threat feeds, and gut feel.
- Informed owners. Asset owners and approvers see why a change is needed before they are asked to make it.
- Clear scope. Teams know which assets a fix will touch and what it will change.
- Measurable outcomes. Every initiative shows how much risk it removes, so you can report progress in reduced risk, not tickets closed.
See the context behind every fix in your own environment. Talk to our team or read about Risk Dimensions and the findings documentation.
EPSS data is published by FIRST. The CISA Known Exploited Vulnerabilities catalog is published by CISA.
