SOC Simulation: Vulnerability Risk Prioritization
Analyze raw vulnerability scan data, filter through the noise, and apply core risk management formulas to prioritize critical SOC operations.
Scenario Context
You are the Tier 3 analyst on shift for a large financial institution. The engineering team recently deployed a new Tenable Nessus vulnerability scanner across the entire enterprise. It was integrated directly into your Splunk SIEM without prior filtering.
The Level 1 (L1) analysts are currently overwhelmed. The SIEM dashboard is flooded with over 4,500 "CRITICAL" vulnerability alerts generated in the last hour. An L1 analyst opens an urgent IR ticket, demanding that the patching team take down 50 internal servers immediately to patch CVE-2023-46805 based purely on its CVSS Base Score of 9.8.
You need to stop the L1 from causing a massive, unnecessary business outage. You pull up the raw logs to demonstrate the difference between a vulnerability's severity and its actual risk level to the business.
Security Environment: SIEM Telemetry
Index: vuln_scans | Sourcetype: nessus:json
{ "timestamp": "2026-04-08T14:32:01Z", "asset_ip": "10.10.50.22", "network_zone": "Internal_Airgap_Vault", "cve": "CVE-2023-46805", "cvss_v3_base": 9.8, "severity": "CRITICAL", "internet_exposed": false, "compensating_controls": ["strict_fw", "no_route"] }
{ "timestamp": "2026-04-08T14:32:05Z", "asset_ip": "203.0.113.44", "network_zone": "DMZ_Public_Facing", "cve": "CVE-2024-21887", "cvss_v3_base": 9.1, "severity": "CRITICAL", "internet_exposed": true, "ips_alerts_24h": 142 }
Incident Response Question
Which of the following formula represents the risk levels?
Tier 3 Analyst Debrief
ExamRange Mentor Insights
What is happening here?
The L1 analyst fell victim to a classic SOC trap: Alert Fatigue driven by Severity without Context. A CVSS base score represents Severity—the inherent technical characteristics of a vulnerability. However, CVSS does not know your network topology. Taking down 50 critical air-gapped servers (Log 1) for a high-severity flaw with near-zero exploit probability destroys business continuity for no real security gain. Meanwhile, the internet-facing server (Log 2) is actively being probed and poses an immediate threat.
Why C is Correct
Risk = Consequence × Likelihood. (Also expressed as Risk = Impact × Probability). To calculate true risk, you must cross-reference "How bad would it be if compromised?" (Consequence/Impact) with "How likely is it that an attacker will actually reach and exploit it?" (Likelihood).
Why Others are Wrong
- Option A: Severity is static. It ignores exposure.
- Option B: Consequence and Impact are synonymous. Multiplying them is redundant nonsense.
- Option D: Asset Value is already a sub-component calculated inside the Consequence variable.
Mini-Lesson: Contextualizing Threat Intel
In a modern SOC, you will rarely use this formula with raw numbers (e.g., 5 × 4 = 20). Instead, you use it as a logical framework for Qualitative Risk Analysis to prioritize tickets.
- Step 1 (SIEM Ingestion): Tool finds CVE-2023-46805 (Severity: Critical).
- Step 2 (Determine Consequence): System is a Vault server. If breached, the company goes bankrupt. (Consequence: High).
- Step 3 (Determine Likelihood): Server is air-gapped, no routing from internet, compensating controls verified in firewall logs. (Likelihood: Low).
- Step 4 (Calculate Risk): High Consequence × Low Likelihood = Medium Risk. Add to routine patch cycle. Do not wake up the admins at 3 AM.
Want to test your incident triage skills further?
Explore more CSA Simulations