Vulnerability Prioritization for Exploitation

You have completed a vulnerability scan and identified 47 findings across a target environment. You have limited time and need to decide which to exploit first.

**Scoring Beyond CVSS**
- Why is CVSS score alone a poor prioritization metric in a real engagement?
- What factors actually determine exploitability in context? (network position, authentication required, patch status, compensating controls)
- How do you weight a low-CVSS finding that gives code execution vs a Critical-CVSS finding that is unpatched but unexploitable in this network?

**Attack Chain Thinking**
- How do you chain low-severity findings together for higher-impact results?
- What is a "pivot point" vulnerability and why does it deserve higher priority than its standalone severity suggests?
- How do you build an attack graph from your vulnerability list?

**Exploitation Complexity**
- How do you assess the reliability of a public exploit before using it?
- What is the difference between a PoC that demonstrates the bug vs a weaponized exploit ready for use?
- How do you estimate the time cost of developing a custom exploit vs moving to another target?

**Business Logic**
- How does the business context of a target change which vulnerabilities you pursue?
- Why might a data exposure vulnerability with no CVE be more impactful than a remote code execution in a test environment?

Output:
- Prioritization matrix template (impact × exploitability × position × business context)
- Decision flowchart for "exploit now / research / skip"
- 5 examples of finding chains that compound impact