Every security team has a "critical" list. Very few of them are a priority list. A vulnerability score describes how dangerous a flaw is in the abstract — it says nothing about whether an attacker can reach it on your estate, or whether anyone is actually exploiting it right now. Those are the two facts that decide what you should fix first, and a raw severity rating knows neither.
The challenge: severity is not risk
A severity score answers one question: "how bad is this weakness in a lab?" It does not answer the question your team actually needs answered: "can an attacker reach it here, and are they using it?"
Those are very different things. A maximum-severity vulnerability on a service that nothing can reach is, in practice, low risk. A mid-severity flaw on a live, internet-facing service that criminals are actively exploiting is an incident waiting to happen — yet on a severity-sorted list it sits politely below a dozen unreachable "criticals". So teams spend their scarcest resource — analyst time — working top-down through a queue that was never ordered by real risk.
The industry now has a name for the shift away from this: Continuous Threat Exposure Management (CTEM). Its core idea is simple — prioritise by what is exploitable and reachable, not by what scores highest. The Australian Signals Directorate makes the same point in the Essential Eight, where patch priority is driven by active exploitation, not severity alone.
A maximum-severity vulnerability on a service that nothing can reach is, in practice, low risk. A mid-severity flaw on a live, internet-facing service that criminals are actively exploiting is an incident waiting to happen.
What's new: a queue ordered the way risk actually runs
TONK, our external attack surface management (EASM) platform, now ranks your remediation queue by real-world risk, not raw severity. Each exposure's urgency reflects whether it is reachable from the outside and whether the underlying weakness is being actively exploited in the wild — so a reachable, actively-exploited medium can rightly rise above an isolated high, and the "fix this next" order matches the order an attacker would work in.
Known-exploited issues are impossible to miss: a weakness on the United States Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalogue is surfaced prominently and never hidden behind a cooler severity colour. At the same time, TONK is honest about uncertainty. A finding based on weak evidence — an unconfirmed software version, a disputed advisory — is flagged as low-confidence rather than paraded as urgent, so your team spends its time on exposures that are real, reachable, and in use.
The result is a single ranked view of your estate: one list, ordered the way risk actually runs, with the reasoning behind each position visible so you can trust the order instead of re-deriving it by hand.
Key capabilities
- Risk-based ranking — your queue is ordered by reachability and active exploitation, not by severity score alone.
- Known-exploited, front and centre — actively-exploited weaknesses (CISA KEV) are surfaced prominently and never hide behind a lower severity colour.
- Reachability first — internet-reachable exposures rise above inside-only noise, so the headline matches real risk.
- Confidence-aware — findings built on uncertain evidence are flagged rather than escalated, so you don't chase ghosts.
- Explainable order — every position shows why it ranks where it does; the order is defensible, not a black box.
Who benefits
Security teams measured on outcomes rather than ticket counts benefit most — because a risk-ordered queue turns a wall of findings into a short list of decisions. Organisations aligning to the ASD Essential Eight, the ACSC Information Security Manual (ISM), APRA CPS 234 or the Security of Critical Infrastructure (SOCI) Act gain a prioritisation model that matches what those frameworks already ask for.
How it works
Risk-based prioritisation is built into the view you already use:
- Open your exposures and see them in the recommended — risk-ordered — sequence by default.
- Read why each exposure ranks where it does: reachable, actively-exploited, or flagged low-confidence.
- Switch to a strict-severity view any time you need the classical ordering.
- Act on the top of the list, or route it to your ticketing — confident it is the right top.
Getting started
Risk-based ranking is available now to TONK clients. Log in to your dashboard to see your exposures in the order that matters, or schedule a demo to see it on your own estate.