SC5 Risk Score
What it is
The SC5 Score (version SC5-VRS-1.3) is scani5 's proprietary Vulnerability Risk Score. It produces a single 0–100 score per CVE that blends technical severity with real-world exploit and threat intelligence.
Traditional CVSS scores treat all "Critical" vulnerabilities equally. SC5 distinguishes between a theoretical critical flaw and one with active ransomware exploitation, a Metasploit module, and a CISA KEV listing.
How the score is built
| Factor | What it reflects |
|---|---|
| Base Impact | CVSS severity (v3 preferred, v2 fallback) |
| Exploit Factor | Presence of public, validated, or weaponized exploits |
| Threat Factor | KEV status, in-the-wild exploitation, threat actor activity |
| Exploitability Modifier | Network attack vector, no privileges required, no user interaction |
| EPSS Factor | Higher EPSS probability increases the score |
| Age Factor | Newer CVEs receive a slight boost; very old CVEs are slightly discounted |
| Penalties | Reduced score when no exploit artifacts or threat intelligence exist |
| Decision Floor | Weaponized exploits guarantee a minimum score of 25 |
Priority bands
| Score | Priority | Label | Recommended SLA |
|---|---|---|---|
| 90–100 | P1 | CRITICAL | 24–48 hours |
| 70–89 | P2 | HIGH | 72 hours |
| 40–69 | P3 | MEDIUM | 7 days |
| 20–39 | P4 | LOW | 30 days |
| 0–19 | P5 | INFO | Track only |
Highlights
- Transparent factor breakdown — every score includes contributing factors and evidence.
- SSVC decision — weaponized exploits trigger an ATTEND decision; others default to TRACK.
- Actionable prioritization — teams can sort and remediate by SC5 score rather than CVSS alone.
Pair with Business Context Score to combine global exploit risk with organization-specific business impact.