Risk framework
Four complementary frameworks
🎚️ RATM output
Risk-Based Alert Triage Matrix. Composite rating across asset criticality, threat intent, exploitation scope, and business impact. The verdict you write in the case.
🧭 P.A.C.E. process
Potential impact, Actor sophistication, Context, Escalation criteria. The four-step think-through that gets you to the verdict.
🎯 MITRE ATT&CK vocabulary
Maps observed behaviors to a shared taxonomy of adversary tactics, techniques, and procedures.
📈 CVSS severity
Standardized numerical severity for vulnerabilities, adapted for active-threat prioritization.
🎚️ Risk-Based Alert Triage Matrix
The RATM scores alerts across four dimensions, producing a composite rating. It emphasizes technical reality while integrating business context.
Asset criticality
Is the affected system, user, or service essential to operations, or does it hold sensitive data? High-value assets (production environments, financial systems, PII repositories) warrant greater concern. Requires understanding of both technical function and business value. Inventories with criticality ratings must be reviewed and updated, or risk assessments will misrepresent actual business impact.
Threat actor intent
Is the alert opportunistic behavior or targeted activity? Sophisticated, deliberate techniques raise priority. Indicators of intent include reconnaissance focused on specific high-value targets, custom malware designed to evade detection, or attack patterns suggesting familiarity with the organization’s architecture.
Exploitation and scope
Did the exploit succeed? Is lateral movement, persistence, or privilege escalation possible? Verified compromise or multi-host activity escalates risk significantly. The scope dimension evaluates both the current footprint and the potential to expand. Evidence of successful exploitation (command execution, data access, configuration changes) raises the rating.
Business impact
What downstream effects on availability, integrity, or confidentiality? Could legal or regulatory consequences follow? Business disruption or reputational harm elevates response priority. Translates technical events into terms organizational leadership recognizes: continuity, customer trust, contractual obligations, financial exposure.
Scoring rubric: how to convert observations into High / Medium / Low
The four dimensions above are the categories. The table below is the operational rubric, what counts as High, Medium, or Low for each. Calibrate the thresholds to your environment, but start from these defaults so two analysts working the same case land at the same score.
🧭 P.A.C.E. Model
P.A.C.E. is a step-by-step model that guides analysts through four key dimensions. It helps evaluate consequences, Threat Actor Individual or group that conducts malicious activities targeting information systems or networks. sophistication, context, and predefined escalation criteria to determine whether immediate action or further investigation is required.
Potential impact
Evaluates the potential consequences if the event remains unresolved. Data breach, system downtime, reputational harm, each raises prioritization.
- Measures severity of possible outcomes
- Considers both short and long-term effects
- Maps to business continuity concerns
Actor sophistication
Assesses skill level and resources. Amateur group or APT? Higher sophistication signals a more dangerous threat.
- Evaluates technical complexity of observed TTPs
- Considers attribution to known threat groups
- Examines customization versus off-the-shelf tooling
Context
Examines evidence supporting alert legitimacy. Match to known attack patterns or correlation with related IOCs raises priority.
- Correlates activity with historical patterns
- Considers normal vs. abnormal for users / systems
- Incorporates threat intel and current campaign awareness
Escalation criteria
Defines clear triggers for when an alert should escalate. Predefined thresholds, significant operational impact, evidence aligned with known threat models.
- Applies organization-specific thresholds
- Ensures consistent decision-making
- Supports defensible triage outcomes
🎯 MITRE ATT&CK as a risk lens
ATT&CK enters Risk as a structuring vocabulary, not a scoring tool. The framework’s value at this phase is naming what was observed so the verdict aligns with the broader Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit; risk is the product of threat, vulnerability, and impact. landscape.
Tactic-level severity weighting
Some tactics carry inherently higher risk than others. Initial Access without follow-on activity is lower risk than confirmed Lateral Movement or Exfiltration. The tactic chain itself shapes priority.
Technique-to-actor mapping
Procedures associated with specific threat actors raise the risk weight. Custom tooling or rare techniques generally indicate targeted activity rather than commodity attacks.
Coverage gap indicators
When the observed chain includes techniques the SOC does not yet have detection for, that gap itself is a risk signal, both for this case and for the program.
📈 CVSS adaptation for triage
CVSS Common Vulnerability Scoring System. A numerical score (0 to 10) describing the severity of a vulnerability across exploitability, impact, and contextual factors. Originally designed for vulnerability management; adapted for active-threat prioritization. applies structured methodology to assess risk. By considering attack vector, complexity, and the system’s impact on confidentiality, integrity, and availability, CVSS provides a standardized approach to prioritize alerts.
The numerical scoring system (0–10) provides clear thresholds for escalation, with scores grouped into qualitative severity ratings (Low, Medium, High, Critical).
Base score
Reflects the intrinsic severity. Attack vector, privileges required, impact on confidentiality / integrity / availability. A higher score typically indicates a more critical alert.
Temporal score
Modifies the base score based on current exploitation trends and available mitigation techniques. Adjusts urgency as the threat landscape evolves.
Environmental score
Tailors the score to the organization’s infrastructure, business priorities, and existing controls. Evaluates whether critical systems are at risk and whether compensating controls reduce overall exposure.
The triage matrix in practice
The four frameworks combine into a composite verdict. The triage matrix below is the practical output: impact and likelihood combine into a default action.