Ransomware risk scoring: are your vulnerability controls keeping up?

TL;DR: Newly disclosed vulnerabilities are rated by similarity to flaws used in ransomware attacks, using more than 60 technical factors and near real-time updates to help teams prioritise what is most likely to be exploited, according to Flashpoint. Severity alone is no longer enough when exploitation patterns, not just scores, determine operational risk.

Editorial analysis by NHI Mgmt Group, based on content published by Flashpoint: “Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization”.

By the numbers:

• RaaS attacks rose by 45% period-over-period in H1 2026.

Key questions

Q: What should security teams do when a vulnerability looks exploitable but is not yet confirmed in the wild?

A: Treat it as a live prioritisation problem, not a waiting game.

Q: Why do ransomware-specific vulnerability scores matter more than CVSS alone?

A: CVSS measures potential severity, but ransomware actors choose flaws based on speed, repeatability, and operational payoff.

Q: What are the signs that a vulnerability prioritization model is failing?

A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths.

Practitioner guidance

• Prioritise vulnerabilities by ransomware resemblance Use a threat-informed score alongside CVSS and EPSS so remediation decisions reflect how closely a flaw matches known ransomware-exploited patterns, not just abstract severity.
• Separate exploitability from business impact Weight unauthenticated remote exposure, OT or SCADA reachability, and data availability impact more heavily than generic severity in backlog reviews.
• Create Day Zero remediation triggers Escalate newly disclosed flaws immediately when similarity signals place them in a ransomware-prone cluster, rather than waiting for public exploit reports.

Bottom line: Ransomware-focused scoring changes the question from how severe a vulnerability is to how likely it is to matter to attackers.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →