The risk exposure index (REI) is a composite measure of an organization’s current exposure to cybersecurity risk. It brings together vulnerabilities, their likelihood of exploitation, and their potential business effects. Rather than treating every finding as equally urgent, REI gives decision-makers a basis for prioritizing security improvements. section 10.2 section 10.2.1
Inputs to consider include:
- Vulnerability counts from scans, tracked over time or by system or asset group. section 10.2.1
- Severity and exploitability. CVSS scores classify severity, but a count alone does not show which findings pose the greatest risk. section 10.2.1
- Threat intelligence and business effects, so the measure reflects likely attacks and organizational consequences—not just technical findings. section 10.2 section 10.2.1
From scan results to a decision
A security team runs routine OpenVAS scans, reviews the vulnerabilities and their CVSS scores, and uses those results to calculate a severity-based REI. A dashboard can help analysts spot critical findings across assets. For leadership, the useful question is not merely whether the score rose, but which systems and vulnerabilities now warrant investment or mitigation. A severity sum is a practical starting point; it does not, by itself, capture every factor in the broader composite measure. section 10.2.5 section 10.2 section 10.2.1
Reassess exposure as conditions change. A newly discovered exploitation method can make a previously low-risk vulnerability more urgent, so periodic counts alone may miss a shift in priorities. REI supports proactive mitigation when scan results are considered alongside current threat information and business impact. section 10.2 section 10.2.1
