Risk framework
One scoring model, two supporting lenses
🎚️ RATM scoring
Risk-Based Alert Triage Matrix, ASSURED’s own scoring model. Four scoring dimensions with a High/Medium/Low rubric, reduced to the impact and likelihood axes of the triage matrix. The verdict you write in the case.
🎯 MITRE ATT&CK vocabulary
Maps observed behaviors to a shared taxonomy of adversary tactics, techniques, and procedures. Names what happened; does not score it.
📈 CVSS severity
Standardized numerical severity for vulnerabilities. An input to the RATM when the alert is exploit-driven, not a verdict on its own.
What is borrowed and what is ours
A structured assessment makes Risk repeatable across analysts and incidents: it reduces variability from individual judgment, creates a shared vocabulary for handoff, and accelerates onboarding. Two of the lenses here are industry standards, MITRE ATT&CK A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and security operations. and Common Vulnerability Scoring System (CVSS) A standardized way to assess the severity of security vulnerabilities. . The RATM is this methodology’s own construct, not an external standard; adapt its rubric to your industry, Regulatory Requirements The legal and contractual obligations that attach to specific data types and industries, such as GDPR, HIPAA, and PCI DSS (a card-industry standard enforced by contract rather than statute), including breach-notification deadlines. They matter in triage because an incident touching regulated data starts a clock the response has to honor. , and risk tolerance. What matters is that the whole team scores from the same calibrated rubric, whatever its anchors say.
Risk-Based Alert Triage Matrix
The RATM scores alerts across four scoring dimensions, producing a composite rating. It emphasizes technical reality while integrating business context. The four scoring dimensions reduce to the two axes of the triage matrix at the bottom of this page: asset criticality + business impact make up the impact axis; threat actor intent + exploitation & scope, weighted by evidence quality, make up the likelihood axis. Score the dimensions, reduce them to the two axes, read the default action off the matrix.
The reduction is deterministic, so two analysts working the same facts land on the same cell:
- Impact is the higher of asset criticality and business impact. A crown-jewel system with no business effect observed yet still scores High, because impact answers “if this is real, how bad,” not “how bad so far.”
- Likelihood starts at evidence confidence and is only calibrated downward or sideways by the other dimensions, never raised above what the evidence supports. Threat actor intent and exploitation & scope inform the score; sophistication is not a substitute for evidence. The impact + likelihood page defines the axis.
- Unknown is not Low. A dimension that cannot be assessed because telemetry or context is missing scores Medium at minimum, and the gap is recorded as an open question. “We could not check” never reads the matrix from the same cell as “we checked and it is clean.”
Asset criticality
Is the affected system, user, or service essential to operations, or does it hold sensitive data? High-value assets (production environments, financial systems, PII repositories) warrant greater concern. Requires understanding of both technical function and business value. Inventories with criticality ratings must be reviewed and updated, or risk assessments will misrepresent actual business impact.
Threat actor intent
Is the alert opportunistic behavior or targeted activity? Sophisticated, deliberate techniques raise priority. Indicators of intent include reconnaissance focused on specific high-value targets, custom malware designed to evade detection, or attack patterns suggesting familiarity with the organization’s architecture.
Exploitation and scope
Did the exploit succeed? Is lateral movement, persistence, or privilege escalation possible? Verified compromise or multi-host activity escalates risk significantly. The scope dimension evaluates both the current footprint and the potential to expand. Evidence of successful exploitation (command execution, data access, configuration changes) raises the rating.
Business impact
What downstream effects on availability, integrity, or confidentiality? Could legal or regulatory consequences follow? Business disruption or reputational harm elevates response priority. Translates technical events into terms organizational leadership recognizes: continuity, customer trust, contractual obligations, financial exposure.
Scoring rubric: how to convert observations into High / Medium / Low
The four scoring dimensions above are the categories. The table below is the operational rubric, what counts as High, Medium, or Low for each. Calibrate the thresholds to your environment, but start from these defaults so two analysts working the same case land at the same score.
Calibration note
The thresholds above are starting defaults. Two adjustments most teams make: (1) move Asset criticality High to match your actual regulated-asset inventory, not a textbook one, if you have no PCI footprint, “regulated-data store” needs a different anchor; (2) treat Threat actor intent High as a confidence-gated upgrade, if attribution is speculative, score Medium and note the upgrade path in the RATM record.
MITRE ATT&CK as a risk lens
ATT&CK enters Risk as a structuring vocabulary, not a scoring tool. The framework’s value at this phase is naming what was observed so the verdict aligns with the broader Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. landscape.
Tactic-level stage context
How far the confirmed chain has progressed shapes priority: Initial Access without follow-on activity is a smaller case than confirmed Lateral Movement or Exfiltration. The stage must be evidenced, not inferred from a technique’s name; a tactic label alone never raises the score.
Technique-to-actor mapping
Procedures associated with specific threat actors raise the risk weight. Custom tooling or rare techniques generally indicate targeted activity rather than commodity attacks.
Coverage gap indicators
When the observed chain includes techniques the SOC does not yet have detection for, that gap itself is a risk signal, both for this case and for the program.
ATT&CK alone is not the verdict
Mapping to MITRE ATT&CK A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and security operations. is necessary but not sufficient. The framework names what happened; it does not say how much it matters in this environment for this asset. Pair the ATT&CK mapping with the RATM rubric to translate technique-level observations into business-level priority.
CVSS adaptation for triage
CVSS Common Vulnerability Scoring System. A numerical score (0 to 10) describing the severity of a vulnerability across exploitability, impact, and contextual factors. Originally designed for vulnerability management; adapted for active-threat prioritization. applies structured methodology to assess risk. By considering attack vector, complexity, and the system’s impact on confidentiality, integrity, and availability, CVSS provides a standardized approach to prioritize alerts.
The numerical scoring system (0–10) provides clear thresholds for escalation, with scores grouped into qualitative severity ratings (Low, Medium, High, Critical).
The three metric groups below are the CVSS v3.1 taxonomy, still the most widely deployed in scanners and feeds. CVSS v4.0 (released 2023) reworks the same ideas: the Temporal group becomes Threat metrics, and a Supplemental group is added. The triage guidance on this page applies to both versions.
Base score
Reflects the intrinsic severity. Attack vector, privileges required, impact on confidentiality / integrity / availability. A higher score typically indicates a more critical alert.
Temporal score
Modifies the base score based on current exploitation trends and available mitigation techniques. Adjusts urgency as the threat landscape evolves.
Environmental score
Tailors the score to the organization’s infrastructure, business priorities, and existing controls. Evaluates whether critical systems are at risk and whether compensating controls reduce overall exposure.
When CVSS misleads
FIRST, which maintains CVSS, is explicit that the Base score measures the severity of a vulnerability, not the risk of an event that involves it. A CVSS 9.8 on an asset that is not exposed, not in use, or already mitigated by compensating controls deserves a different response than the same score on a production system. Use CVSS as input, then weight it by the context Subject and Scope provided. The base score is a starting point; the environmental score, and the RATM around it, is what makes the triage decision.
CVSS is also no longer the only prioritization signal. EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will be exploited in the wild within the next 30 days, and CISA’s KEV catalog lists vulnerabilities with confirmed active exploitation. When a triage case pivots on a vulnerability, KEV membership or a high EPSS score is usually a stronger urgency signal than the CVSS base score alone: a 9.8 nobody exploits matters less this shift than a 7.2 being actively used.
The triage matrix in practice
The triage matrix is the practical output: impact and likelihood combine into a default action. Likelihood here means what Impact + likelihood defines: confidence that the activity is real and malicious. The probability that an attack continues or spreads is a separate consideration, scored inside the RATM’s exploitation & scope dimension, not smuggled into this axis. Each default action carries the priority band (P1–P4) that the Escalation criteria page defines.
The override rules: when the matrix is not the last word
The matrix cell is the default action. Exactly three overrides can modify it, applied in this order, and the case record names the rule that fired. These are the same rules the Escalation criteria page enforces; there is one contract, stated here, consumed there.
1 · Break-glass, up to P1, from any phase
Any escalation criterion confirmed makes the case P1 immediately, whatever the cell: confirmed malicious activity, confirmed malicious or unauthorized activity touching a business-critical asset, confirmed lateral movement or exfiltration, or a confirmed active campaign. Confirmation means evidence, not asset value: a crown-jewel alert with nothing validated yet has not broken glass.
2 · The high-impact clock, tightening P3
A High-impact case never idles on uncertainty. If likelihood is genuinely Low because the evidence affirmatively leans benign, the High/Low cell stands at P3, but on a tightened clock: re-score within hours, not the standard 24 (calibrate the exact number, keep it a small fraction), with named upgrade triggers and the queue lead or asset owner aware the case exists. If likelihood is “Low” only because evidence is missing or unobtainable, that is Unknown, which scores Medium under the reduction rule, and the case reads High/Medium: P2, escalate within the shift.
3 · De-escalation is explicit
A priority moves down only with a named reason recorded in the case and the same stakeholder notification the upgrade would get. Silent decay is how a P2 becomes nobody’s problem.
Run the hardest case through the contract to see it hold: a domain controller alert with weak, incomplete evidence. Impact High (asset criticality). Evidence missing, not benign-leaning, so likelihood reads Medium, the cell is High/Medium, and the action is P2 within the shift, on every page of this site. If instead the evidence is present and points benign, it is High/Low: P3 on the tightened clock. Neither branch waits 24 hours, and neither branch pages IR at 3 a.m. on asset value alone.
Translate the timing anchors to your team model
The clock words above are written for a shifted, multi-analyst SOC. On a small or single-person team, translate them without loosening them: “escalate” means engaging whatever your escalation path is (an on-call engineer, an MSSP, an IR retainer), “within shift” means before you stop working the queue today, and “closure within 24 hours” means before the case goes stale. What must survive the translation is the ordering: P1 interrupts whatever you are doing, P2 finishes today, P3 is allowed to wait its turn.
Know the matrix's failure modes
Qualitative impact × likelihood matrices have documented weaknesses (Cox, 2008): range compression (two Medium/Medium cases can differ by orders of magnitude in real loss), ranking reversals near category boundaries, and anchoring on whichever cell was picked first. The matrix earns its place by making the priority call fast, consistent, and explainable, not by being precise. When a case sits near a boundary or the two axes pull in opposite directions, record the reasoning, not just the cell.
Key Takeaway
The Risk framework produces a verdict the analyst can defend. The RATM rubric does the scoring, ATT&CK names the techniques, and CVSS quantifies Vulnerability A defect in a system that can be turned into adversary capability if paired with an exploit and exposure: an unpatched CVE, a misconfiguration, a default credential, a logic flaw. Vulnerability without exposure or exploitability is latent; with both, it's a finding. severity when one is in play. Real triage is five moves: score impact, score likelihood (unknown is not Low), read the matrix, apply the override rules, act on the band. Everything else on this page exists to make those five moves repeatable across analysts.