Threat-Informed Vulnerability Prioritisation: Temporal Validation and a Formal Design for Organisational Context

Abstract

Vulnerability prioritisation remains a critical cyber risk-governance challenge for organisations with limited remediation resources. This study makes two contributions. First, it evaluates a threat-informed Key Risk Indicator combining exploitation probability, technical severity, and weakness-level exploitation prevalence. To prevent temporal leakage, weakness weights were estimated from 87,080 vulnerabilities published between 2020 and 2023 and fixed before evaluation on 59,638 vulnerabilities published between January 2024 and May 2025. For each evaluation CVE, KRI used the first archived EPSS score identified on or within two calendar days after publication. KRI achieved an area under the precision-recall curve of 0.053, compared with 0.014 for severity-only prioritisation, and captured 14.6% of CVSS-weighted KEV value within the top 500 vulnerabilities, compared with 6.6%. Second, the study introduces the Context-Adjusted Key Risk Indicator as a formal organisation-aware extension incorporating control implementation and asset context. Synthetic scenarios illustrate its computation but do not validate organisation-specific effectiveness, which requires real organisational measurements and an organisation-sensitive reference outcome. The findings support threat-informed prioritisation while establishing a design for future organisational validation.