Verdict mix
Reachability vs consequence
Bubble size is threat. The top-right corner is the work; the left edge is noise that a severity-only view would have ranked identically.
What the analysis removed
A severity-driven queue would call 27 of these urgent (CVSS ≥ 7). Measuring exposure where you actually run them leaves 12, which is 56% of that queue removed, and what is left is 10 package upgrades, because one bump closes every CVE that package carries. Separately, and not counted as analysis, those 28 rows describe 26 distinct CVEs across 28 CVE-by-asset decisions. A scanner emits one row per (CVE, project, manifest), which inflates the count before anyone judges anything.
The same findings, ranked three ways
| ranked by | Critical | High | other |
|---|---|---|---|
| Scanner | 15 | 10 | 3 |
| CVSS, from NVD | 14 | 13 | 1 |
| this analysis | Contain | Remediate | Schedule | Accept |
|---|---|---|---|---|
| verdict | 8 | 4 | 8 | 8 |
The scanner called 15 of these Critical; NVD’s CVSS calls 14 Critical; measuring exposure where you actually run them leaves 12 needing action and 8 accepted. The first two rows disagree because a scanner’s own rating is not CVSS. Neither is wrong, and neither is a verdict. “Other” is everything rated below High. Accepted findings are recorded with their reasoning in the workbook’s Accepted sheet.
Where the work sits: business unit by verdict
| business unit | Contain | Remediate | Schedule | Accept | all |
|---|---|---|---|---|---|
| Commerce | 8 | 4 | 2 | · | 14 |
| Operations | · | · | 4 | 1 | 5 |
| Corporate | · | · | 2 | 3 | 5 |
| Data | · | · | · | 4 | 4 |
Colour is the verdict, depth is the count. Rows are ordered by total exposure, so the top row is where attention buys the most. A row that is wide on the right and empty on the left is carrying volume, not risk.