Most security backlogs are sorted by a number that was assigned before anyone knew where the affected system sits. The severity of a vulnerability describes the vulnerability. It does not describe your environment, and it certainly does not describe what happens to your business if the thing is exploited.
This is why teams that work strictly by severity find the backlog grows no matter how fast they close tickets. They are sorting by the wrong key.
Reachability is the first filter
Before anything else, ask whether the affected asset can be reached at all. Not whether it is theoretically reachable in an unlucky configuration — whether traffic can arrive there today, from where, and carrying what credentials. In practice this single filter removes most of a posture tool's output.
Reachability is computed, not estimated. Network routes, trust policies, credential locations and admission rules are all machine-readable. If you are guessing at reachability, you are guessing at priority.
Consequence is the second filter
Of the findings that survive the first filter, the ones that matter are those sitting on a path that terminates somewhere expensive. Regulated data, the system of record, the secrets store, the thing your revenue depends on.
A path is only interesting because of where it ends. Score the destination, then score the path, then score the finding.
What to do with everything else
Be honest about it. Findings that are unreachable, or that reach nothing of value, go into the normal engineering backlog with a normal engineering priority. They are hygiene, and hygiene is real work — it is just not incident work.
- Publish the rule you use to decide, so teams can predict what will land on them.
- Never escalate a finding to an engineering team without naming the path it sits on.
- Review accepted risk on a date, not on a feeling.
- Measure the count of paths to your crown jewels, not the count of open findings.
The number that actually moves
When teams switch from counting findings to counting paths, two things happen. The number gets small enough to reason about, and it starts going down. Both of those are worth more than a tidy severity histogram.
Every company, figure and quotation in this article is fictional sample content written for the template.