First developed as part of our TRACE Score whitepaper, May 2026. Expanded and updated for this site.

TRACE Score: How We Prioritize Vulnerabilities When Everything Is Critical

Your vulnerability scanner just returned 14,000 findings. CVSS says 3,200 of them are Critical. Your team can remediate maybe 200 this sprint. Which 200?

CVSS is a severity label, not a prioritization tool --- the industry just forgot the difference. CVSS measures the intrinsic characteristics of a vulnerability in the abstract. It has no concept of where the affected asset sits in your network, what data it touches, which compliance frameworks apply, or whether an active threat campaign is exploiting it right now. Two assets running the same CVE always get the same CVSS score, even when one is an internet-facing portal handling Controlled Unclassified Information and the other is an isolated build agent inside a segmented zone.

EPSS predicts exploitation probability, but without asset or organizational context. KEV is reactive --- a CVE enters the Known Exploited Vulnerabilities catalog only after compromise has occurred. SSVC is a manual decision tree designed for one vulnerability at a time with a human analyst walking it.

The TRACE Score is Advisedly's answer: a 0-100 score per (CVE, Asset, Organization) tuple that contextualizes vulnerability severity with five auditable components. Every input is attributed, every score is reproducible, and the entire engine runs air-gapped on customer hardware when required.

Why Now: CISA BOD 26-04 and the Death of Flat Prioritization

CISA's Binding Operational Directive 26-04 (issued June 10, 2026) mandates risk-based vulnerability management for federal civilian agencies. The directive specifies four decision signals: Asset Exposure, KEV status, Exploit Automation potential, and Technical Impact. Flat CVSS-based remediation timelines --- "patch all criticals within 15 days" --- are explicitly insufficient under the directive's framework.

BOD 26-04 is the regulatory acknowledgment of what practitioners have known for years: vulnerability volume has outpaced human remediation capacity, and the only viable response is contextual prioritization that concentrates effort where risk actually concentrates. The NVD backlog (20,000+ CVEs awaiting analysis as of early 2026) compounds the problem --- CVSS scores for newly disclosed vulnerabilities are increasingly delayed or absent entirely, leaving organizations without even the blunt instrument of severity labels.

TRACE was designed for exactly this reality: a scoring engine that remains informative even when NVD data is incomplete, that incorporates the BOD 26-04 decision signals as first-class inputs, and that adds organizational and compliance context the directive does not require but federal customers need for ATO and POA&M decisions.

The TRACE Acronym: Five Components

TRACE stands for Threat, Reachability, Asset, Compliance, Exploit. Each component returns a normalized value, a confidence score, a list of sources consulted, and specific signal references. The components combine into a weighted composite with a global confidence factor that penalizes data-sparse scores.

T --- Threat Intelligence

Threat measures whether real adversaries are actively exploiting this CVE against organizations in your sector and region. The component reads active campaign intelligence, sector-specific targeting data, and regional targeting patterns.

Why this matters: two organizations running the same unpatched software face materially different risk if one operates in a sector actively targeted by campaigns exploiting that CVE and the other does not. A defense contractor facing APT groups with confirmed exploitation of a specific CVE has higher Threat signal than a regional retailer running the same software. CVSS cannot distinguish them. TRACE does.

R --- Reachability

Reachability captures whether the vulnerable asset can actually be reached by an attacker and how far lateral movement could extend from it. The component considers the asset's network zone classification --- internet-facing systems score higher than internal systems, which score higher than isolated or air-gapped systems --- and adjusts for blast radius based on network adjacency.

Why this matters: an unpatched Apache instance in your DMZ is a fundamentally different risk than the same instance on an isolated build server behind three layers of segmentation. Reachability captures that difference quantitatively rather than leaving it to analyst judgment call by call.

A --- Asset Criticality

Asset criticality reflects the business importance of the host and the sensitivity of the data it processes. The component maps from the asset's criticality classification (low through critical) and adjusts for data sensitivity markers (CUI, PII, PHI, classified) and the presence of documented compensating controls.

Why this matters: the domain controller authenticating every user is not the same risk as a test VM running the same unpatched service. Asset criticality ensures the score reflects business impact, not just technical severity.

C --- Compliance Impact

Compliance impact measures the breadth of control gaps opened across your contracted compliance frameworks by this vulnerability. The component uses the cross-framework crosswalk engine to map each CVE's CWE classification to impacted controls across every framework the organization has in scope.

Why this matters: for organizations operating under regulatory frameworks, a vulnerability's compliance exposure can be more operationally urgent than its technical severity. A medium-severity CVE that touches 15 controls across three frameworks with an audit deadline in 30 days demands faster attention than a critical-severity CVE that maps to zero in-scope controls. The crosswalk covers 500+ compliance frameworks, so a single CVE on a regulated workload reveals its full compliance surface immediately.

E --- Exploit Maturity

Exploit maturity is the highest-weighted component because it remains informative even when asset and organizational context are sparse. The component reads the best available CVSS source, factors in KEV inclusion (confirmed exploitation in the wild), public proof-of-concept availability, and weaponized exploit existence (framework modules).

Sources consulted include NVD, CNA submissions, VulnCheck Extended KEV, EPSS daily snapshots, ExploitDB, Metasploit Framework, Nuclei Templates, OSV.dev, and GitHub Security Advisories.

Why this matters: exploit maturity is the strongest individual predictor of real-world exploitation risk. When a CVE has a weaponized Metasploit module and KEV listing, the remediation urgency is categorically different from a CVE with only a theoretical attack vector and no known exploitation.

A Walked Example: Same CVE, Two Assets, 30-Point Spread

Consider a hypothetical critical CVE: CVSS 9.8, weaponized exploit module, listed in KEV, public proof-of-concept available. Two active campaigns target the defense sector in the US region. The CWE maps to 15 controls across NIST 800-53 r5.

Asset A: Internet-facing CUI system. Criticality: Critical. Network zone: Internet-facing. High blast radius. Data classification: CUI. No compensating controls.

All five TRACE components score high. Exploit maturity is maxed (KEV + weaponized + PoC). Threat intelligence is elevated (active campaigns + sector match). Reachability is high (internet-facing + blast radius). Asset criticality is maxed (critical + CUI). Compliance impact is significant (15 controls impacted).

Result: TRACE approximately 85 (high confidence).

Asset B: Isolated build agent. Criticality: Low. Network zone: Isolated. Minimal blast radius. Compensating controls documented.

Exploit maturity scores identically --- same CVE, same exploit signals. Threat intelligence scores identically --- same campaigns exist. But Reachability drops dramatically (isolated, minimal adjacency). Asset criticality drops (low classification, compensating controls reduce further). Compliance impact remains the same (framework mapping is CVE-specific, not asset-specific).

Result: TRACE approximately 55 (high confidence).

A 30-point spread on the same vulnerability. That spread is the per-asset context that CVSS cannot provide. Asset B is still a finding that needs remediation --- but it is not competing for the same sprint slot as Asset A. The team knows which 200 of those 3,200 criticals actually demand this week's attention.

How TRACE Differs from CVSS, EPSS, KEV, and SSVC

Dimension	CVSS	EPSS	KEV	SSVC	TRACE
Scope	Vulnerability-intrinsic	Vulnerability-intrinsic	Vulnerability-intrinsic	Per-vulnerability decision	Per (CVE, Asset, Org)
Asset-aware	No	No	No	Manual analyst input	Yes (R, A components)
Org-aware	No	No	No	Manual analyst input	Yes (T, C components)
Output	0-10 base score	0-1 probability	Boolean	Decision label	0-100 + 5 components + confidence
Reproducibility	Spec-only	Daily snapshot	Boolean	Operator-dependent	Byte-identical replay from persisted signals
Federal audit story	None	None	None	Manual documentation	Reproducible offline; inputs attributed; control-gap mapping built in

TRACE consumes CVSS, EPSS, and KEV as inputs. It is a strict superset --- not a replacement for those systems, but a composition layer that contextualizes them for your specific environment.

BOD 26-04 Alignment

CISA BOD 26-04 mandates four decision signals: Asset Exposure, KEV, Exploit Automation, and Technical Impact. TRACE implements all four as first-class scoring inputs --- Reachability covers Asset Exposure, Exploit Maturity covers KEV and Exploit Automation, and all five components collectively address Technical Impact. TRACE adds two dimensions BOD 26-04 does not require (Threat intelligence and Compliance impact) but that federal customers need for ATO justification and POA&M prioritization.

The Confidence Framework: Honest About Missing Data

The confidence framework has one design goal: never silently substitute a neutral default for missing data. When a source is absent, the component admits uncertainty rather than assuming the median.

A score with four high-confidence components and one unknown is materially different from a score where all five components have moderate confidence. The platform displays both the composite score and the global confidence factor, so analysts can distinguish actionable intelligence from data-sparse estimates that warrant manual investigation.

The global confidence factor penalizes any single low-confidence component harder than arithmetic averaging would. This surfaces the weakest link rather than letting a high-confidence component mask a missing-data hole. Federal customers see a "data quality" indicator on every finding --- analysts instantly know which scores to trust and which to investigate further.

Tunability: Your Weights, Your Risk Posture

Default weights ship with sensible posture for the current data landscape. Organizations can customize per-org weights through platform settings, adjusting emphasis to match their risk profile:

Threat-intel-heavy organizations (dedicated CTI team or commercial feed): emphasize Threat, reduce Exploit weight
OT/ICS or build-system fleets (asset context and segmentation matter most): emphasize Asset and Reachability
Compliance-driven organizations (FedRAMP, CMMC L2, HIPAA audit timelines): emphasize Compliance so remediation queue aligns with controls under assessment
Pure exploit-driven prioritization (want modern exploit signals as primary driver): raise Exploit weight, reduce others proportionally

Weights must sum to 1.0. The global confidence factor is non-tunable by design --- data quality degradation surfaces regardless of weight choice because incomplete data should always be visible to the analyst.

Open Algorithm: Transparency Is a Feature

The TRACE algorithm is publicly disclosed at the component and design level. This transparency is deliberate:

Federal customers demand explainability. A black-box score cannot be defended in an ATO appeal or a POA&M justification. Publishing the design removes the trust barrier on first contact.
The moat is integration depth, not algorithmic secrecy. The 500+ framework crosswalk, the asset graph, the multi-source signal store, the 11-provider BYOAI abstraction, and the federal trust position --- that is the platform value. The composition of five weighted signals is a design pattern. The infrastructure to feed and contextualize those signals at scale is the product.
Transparency is a buying signal in this market. Federal buyers distrust opaque scoring vendors. Publishing the design is a competitive advantage, not a giveaway.

Concentrating Risk at the Top

TRACE is designed so that addressing the highest-scored vulnerabilities addresses a disproportionate share of actual risk exposure. High scores concentrate at the intersection of exploit maturity, reachable assets, critical systems, and compliance-relevant controls. The vulnerabilities at the top of the TRACE queue are those where adversaries are actively exploiting, on systems that matter, with compliance implications if left unpatched.

Compare that to CVSS-based prioritization, where the top tier includes every 9.8+ vulnerability regardless of whether the affected asset is reachable, the exploit is weaponized, or the CVE maps to any in-scope compliance control. Most of those "criticals" are noise for your specific environment. TRACE separates signal from noise by incorporating the context that CVSS was never designed to carry.

Key Takeaways

TRACE scores per (CVE, Asset, Organization) --- not per vulnerability in the abstract --- producing different scores for the same CVE on different assets based on real contextual differences.
Five auditable components (Threat, Reachability, Asset, Compliance, Exploit) each carry independent confidence scores and source attribution.
The confidence framework explicitly surfaces missing data rather than silently substituting neutral defaults --- a score of 78 with confidence 0.92 means something different from 78 with confidence 0.65.
TRACE consumes CVSS, EPSS, and KEV as inputs rather than replacing them --- it is a composition layer that adds the asset and organizational context those systems lack.
BOD 26-04 decision signals are first-class inputs; TRACE adds Threat and Compliance dimensions that federal customers need for ATO and POA&M decisions.
The algorithm runs air-gapped with no external network dependencies; every score is reproducible from persisted signal data.

Frequently Asked Questions

Does TRACE replace CVSS?

No. TRACE consumes CVSS as an input to the Exploit Maturity component. CVSS measures intrinsic vulnerability severity --- TRACE contextualizes that severity with asset, organizational, threat, and compliance signals. You still see CVSS scores; TRACE tells you what those scores mean for your specific environment.

What happens when NVD data is delayed or absent?

The Exploit Maturity component falls back to EPSS probability, CNA-submitted scores, and exploit intelligence sources (KEV, ExploitDB, Metasploit, Nuclei). The confidence score reflects the degraded data quality so analysts know the score is based on fewer sources. TRACE remains informative even in the post-NVD-backlog reality where authoritative CVSS scores are weeks or months delayed.

Can I export TRACE scores for reporting to leadership or auditors?

Yes. Scores export with full component decomposition, confidence factors, and source attribution. For ATO packages and POA&M justification, the per-asset context and confidence indicators provide the evidence auditors need to understand why specific vulnerabilities were prioritized over others.

How often do scores update?

Scores recalculate when underlying signals change: new campaign intelligence, KEV additions, EPSS daily updates, asset inventory changes, or framework scope modifications. The platform tracks score deltas over time, so you can see when a vulnerability's TRACE score increased (new campaign targeting your sector) or decreased (compensating control documented).

Does TRACE work in air-gapped environments?

Yes. The scoring engine runs entirely on customer infrastructure with no external network dependencies. Signal data (EPSS snapshots, KEV updates, campaign intelligence) can be ingested via offline data transfer. Scores are reproducible from persisted signals --- an auditor can independently verify any score by replaying the stored inputs.

How Advisedly Helps

The TRACE Score engine runs against your asset inventory, your compliance frameworks, and current threat intelligence to produce per-asset vulnerability prioritization that answers "which 200 of these 3,200 criticals actually need this sprint" --- with auditable, reproducible, confidence-rated scores that satisfy BOD 26-04 and support ATO/POA&M decisions. Reach out to begin@advisedly.ai