Why is it high? Every point is on the page.
CIR scores are computed from the record, never typed in. Four inputs worth 0 to 3 points each, two
sums, a few overrides. Simple enough to recompute in a meeting, fixed enough that a high
means the same thing in every organization.
Try it
The four inputs
Severity, from core | Points |
|---|---|
| CVSS ≥ 9.0 | 3 |
| CVSS ≥ 7.0 | 2 |
| CVSS ≥ 4.0 | 1 |
| CVSS < 4.0 | 0 |
| No severity | 3 |
Exploitation, from threat_intel | Points |
|---|---|
| Active: in the wild or KEV listed | 3 |
| Public: PoC, functional or weaponized | 2 |
| None | 0 |
No threat_intel layer | 2 |
Exposure, from posture | Points |
|---|---|
| None: not affected, fixed, not deployed | override |
| Contained: isolated, or a full validated block | 0 |
| Controlled: internal, or a partial control | 2 |
| Open | 3 |
No posture layer | 3 |
Impact, from context | Points |
|---|---|
| Critical | 3 |
| High | 2 |
| Medium | 1 |
| Low or none | 0 |
No context layer | 3 |
Severity keeps one CVSS score: issuer over vendor over nvd, then v4.0 over v3.1.
Layers inherited through based_on count as present. The exact conditions are in the
specification.
Two scores
threat_intel.priority. Needs no organizational data: a CERT can publish it.context.score.| Public priority | Level |
|---|---|
| 5 to 6 | critical |
| 4 | high |
| 2 to 3 | medium |
| 0 to 1 | low |
| Organizational risk | Level |
|---|---|
| 10 to 12 | critical |
| 7 to 9 | high |
| 4 to 6 | medium |
| 0 to 3 | low |
Overrides, in order
- Exposure none → level
none, value 0. Nothing to fix here. - Exploitation confirmed in the organization → level
critical, value unchanged. It is an incident. - KEV listed and exposure open → level at least
high.
Built to be trusted
Deterministic
Computed from the record fields only. Two tools reading the same record get the same score.
Explainable
Additive points, no weights, no curve. Anyone can recompute it on a whiteboard.
Versioned
A stored score names its method. Validators recompute it and reject a mismatch.
Comparable
An organization may add its own method, but cir-risk stays the shared reference.
An unknown risk is treated as a dangerous one.