Which factors influence vulnerability remediation prioritization?

• A. Higher CVSS scores indicate severity and always determine priority.
• B. Asset criticality is irrelevant to remediation prioritization.
• C. A combination of CVSS, asset criticality, and exploit availability informs prioritization.
• D. Exploit availability alone drives remediation urgency.

Answer: (C)

Vulnerability remediation prioritization relies on risk, not on a single metric. A CVSS score shows how severe a vulnerability is in theory, but it doesn’t tell you how much that vulnerability matters in your specific environment. Asset criticality is crucial because the impact of exploiting a vulnerability on a mission-critical system or on sensitive data is far greater than on a low-value asset. Exploit availability reflects how likely it is that attackers can and will exploit the flaw now; if there are known public exploits or active campaigns, the urgency to fix it increases.

Combining these factors gives a practical prioritization: a vulnerability with high severity on a critical asset and with available exploits should be tackled first; a high-severity issue on a noncritical asset with no known exploits can be deprioritized. This approach avoids overreacting to severity alone and underreacting to real-world context. In practice, other considerations like patch availability, remediation complexity, and exposure also influence the plan, but the core idea is that a blend of severity, asset importance, and exploit likelihood guides what gets fixed first.