Introducing the SecNode Memory Layer
Blog
ResearchMay 15, 2026 · 6 min

Prioritizing by reachability, not CVSS

CVSS scores a vulnerability class in the abstract. Whether it matters in your environment depends on whether an attacker can reach it, and that's a property of your topology, not the CVE.

A CVSS score describes a vulnerability class in the abstract: how bad this kind of flaw is, in general, for a hypothetical system. It says nothing about whether an attacker can reach the flaw in your environment. And reachability is the whole question. A critical you can't reach is, in practice, a low.

Yet most queues are sorted by severity alone. Teams spend their best hours on a 9.8 that sits behind three layers of network isolation and a role nobody can assume, while a 6.1 on a directly internet-facing service, one hop from data that matters, waits its turn. The score inverted the priority.

Reachability is a topology property

Whether a finding is reachable depends on how your systems actually connect: which services are exposed, which identities can assume which roles, which trust relationships cross which boundaries, and what sits at the end of each path. None of that is in the CVE. All of it is in your environment.

Severity is a property of the vulnerability. Priority is a property of your environment. Confusing the two is why queues never get shorter.

How topology-aware ranking changes the queue

SecNode AI ranks findings by testing them against the Memory Layer's model of your topology. Instead of asking how bad this class of bug is, it asks a sharper question:

  • Can an attacker actually reach this from a position they could plausibly hold?
  • What's at the end of the path: sensitive data, a privilege boundary, production control?
  • Is the exploit real here, confirmed with a reproduction, or theoretical?

A finding that clears all three rises to the top regardless of its base score. One that fails the first drops, no matter how alarming the CVSS. The queue starts reflecting real risk instead of catalog severity.

Why this shrinks the work

The side effect of ranking by reachability is that most of the queue evaporates. A large share of nominally critical findings turn out to be unreachable in a given environment, and once they're ranked accordingly they stop consuming attention. What's left is smaller, truer, and ordered by what an attacker could actually do. That's the only ordering worth acting on.

Put senior-level security engineering on every system you own

See SecNode's agents run a live investigation against a real environment.