Flipping the Criticality Funnel, A Practical Path to Real Prioritization
summary
GitHub describes flipping an inverted risk funnel by building a unified risk score that normalizes findings from 20+ sources and ~200,000 new findings/day, converting a prior state where high security risks were 50% of findings into one where criticals are the least likely finding. The system combines CVSS + EPSS + CISA KEV, asset criticality and FedRAMP SLA mapping, plugs into routing and enrichment pipelines, uses a versioned calculator, risk map and per-score detail for auditability, and tunes weights with calibration sets.
AI-written summary · about
chapters (15)
- 0:00Risk score challenges
- 1:09New risk scores' limits
- 2:13Open auditable risk framework
- 3:35Risk score pipeline at GitHub
- 8:35Three-step prioritization process
- 10:00Audience transparency needs
- 11:44Metric groups and interactions
- 13:08Adapting CVSS and threat data
- 15:32Handling EPSS and qualitative factors
- 17:15Asset criticality in scoring
- 18:20Collapsing threat vectors
- 19:23Final risk score calculation
- 21:27Tuning for accuracy and SLAs
- 22:51Testing and refining model
- 23:12Q&A on EPSS updates
related talks
43mChanging from Probability to Prioritization Method in Risk Measurement
18mNormalizing AppSec Issues for Contextual Risk-Based Prioritization at Enterprise Scale
27mGet Your Security Priorities Straight! How to Identify Workloads Und...
45mThe Business Value of Security
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
27mSolving CISO Headaches: How to Align CTI and Risk Management
50mWhen Everything Is Critical, Nothing Is: ISA and Mitigation Prioritization
27mEffective Vulnerability Management for a DevSecOps Pipeline