Skip to content
Made in the UK

Vulnerability Management

How do you prioritise vulnerabilities: severity, CVSS or number of affected assets?

By , CEO, CybaVerse. Last reviewed

Prioritise vulnerabilities by severity first, use CVSS to break ties, and favour the fixes that clear the most affected assets across every client estate. Then move up anything known to be exploited, internet-facing or business-critical, and anything close to the Cyber Essentials 14-day deadline.

This page is part of our vulnerability management guide for MSPs.

Why can't you just fix everything?

A typical client estate produces far more findings than an MSP can patch in a week, and prospects regularly tell us scanners create "a lot of noise". Prioritisation decides whether engineering time actually reduces risk or just reduces a count. A clear, repeatable method also makes the conversation with clients easier.

What do severity, CVSS and asset count each tell you?

Each measure answers a different question. Severity tells you how bad a finding is, CVSS gives a finer score, and asset count tells you how far one fix will go. The table below shows how to use each one in practice.

MeasureWhat it tells youHow to use it
SeverityCritical: act straight away. High: within days. Medium: plan it in. Low: when you can.First filter
CVSS (0 to 10)Finer score of seriousnessTie-breaker within a severity
Affected assetsHow many devices one fix clearsMaximise risk reduced per hour
Exposure / criticalityInternet-facing or business-criticalMove up the list
DeadlineCyber Essentials 14-day rule for critical/high/CVSS 7+Hard date

How should an MSP prioritise vulnerabilities each week?

Run this routine weekly per client, and daily for critical findings. It takes minutes once your tooling shows everything in one view, and it produces a short, defensible list of fixes your engineers can actually complete. Apply it the same way across clients so results compare.

  1. Step 1: Start with open findings only

    Hide informational and already-fixed items so you work on real, current problems.

  2. Step 2: Filter to critical and high

    These are the findings attackers use and the ones Cyber Essentials cares about.

  3. Step 3: Sort by affected assets

    One update that clears a vulnerability from 30 devices usually beats a fix for one machine.

  4. Step 4: Break ties with CVSS

    Within the same severity, higher CVSS goes first.

  5. Step 5: Raise exploited, exposed and critical assets

    Anything listed in the CISA Known Exploited Vulnerabilities catalogue moves up, as do internet-facing servers, VIP users and business-critical systems. FIRST EPSS scores can help estimate exploitation likelihood.

  6. Step 6: Check deadlines

    Flag anything approaching 14 days since vendor release.

  7. Step 7: Assign, fix and verify

    Assign each fix, apply it, then mark it fixed and confirm with a rescan.

  8. Step 8: Record false positives properly

    If a finding does not apply, record why, who decided and when.

How do you report vulnerability priorities to clients?

Report a short list rather than a long one. Show open critical and high findings, how many were fixed since the last review, average time to fix and anything breaching the 14-day window. Clients understand trends and deadlines far better than raw counts of findings.

  • Open critical and high findings this month versus last
  • Fixes completed and verified
  • Items at risk of breaching 14 days
  • Top three recommended fixes for next month

Where does CybaOps help with prioritisation?

CybaOps gives MSPs continuous vulnerability scanning for every client in one multi-tenant platform, with each finding tied to the assets it affects. That puts the inputs for this method in one place, so engineers can apply the same weekly routine to every client without spreadsheets.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Vulnerability scanning in CybaOps is powered by Qualys.
  • Internal scans run several times a day and external scans run daily.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.
  • MSPs can run CybaOps across all their customers from one multi-tenant platform.
  • CybaOps handles large vulnerability volumes across many customer tenants.
  • Vulnerability data can be exported from CybaOps reports.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.

Vulnerability priority

How to rank vulnerabilities: severity, CVSS, assets

Prioritise vulnerabilities by severity first, use CVSS to break ties, and favour the fixes that clear the most affected assets across every client estate.

01 Scanning

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Vulnerability priority

02 The 8-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Vulnerability management in
  • CybaVM
  • CybaRemediate

What else do teams ask about prioritising vulnerabilities?

These follow-up questions come from MSP engineers and IT managers building a repeatable vulnerability routine.

Is CVSS alone enough?

No. CVSS ignores how many of your devices are affected and whether they are exposed. Combine severity with exposure, the number of affected devices and how important each system is to the client, so effort goes where it reduces the most risk.

How often should we reprioritise?

Weekly for the full list and daily for new critical findings. New vulnerabilities and fixes appear constantly, so a regular review keeps the priority list accurate and makes sure urgent issues are not left waiting for the next scheduled cycle.

What about medium and low findings?

Plan them into regular maintenance once critical and high items are under control. Lower-severity findings still matter, so track them, group similar fixes together and work through them steadily rather than letting them build into a large backlog.

Should internet-facing systems always come first?

Usually yes, within the same severity. Exposed systems can be reached by any attacker, so a high finding on an internet-facing server often matters more than a critical finding on an isolated test machine.

How do we show progress to clients?

Report open critical and high counts over time, and time to fix. Trends are easier for clients to understand than raw lists, and showing these figures regularly helps demonstrate that risk is falling and the service is delivering value.

What should you do next?

See vulnerability management on the CybaOps Platform page. MSPs can learn about multi-tenant delivery on the Partner page.

Related: How do MSPs meet the 14-day remediation rule across every client? and How do you automate vulnerability remediation workflows?

See prioritised vulnerabilities across client tenancies.

Book a CybaOps demo