Methodology v1.0

Transparent vulnerability prioritisation

Cornish Geek Signal

A public 0–100 indicator of how strongly current evidence supports operational attention. It is designed to explain priority, not replace organisational risk assessment.

Interpretation

Signal bands

85–100Fix now

Immediate investigation, mitigation or remediation.

65–84Investigate

Prioritised exposure and applicability assessment.

40–64Watch

Monitor evidence and establish local exposure.

0–39Low signal

Low immediate concern without additional context.

Deterministic model

How the score is built

Every factor has a published maximum. The same evidence always produces the same score.

30 points

Exploitation evidence

Verified attacker activity receives the strongest weighting.

15 points

Authoritative status

KEV inclusion and ransomware association provide authoritative context.

20 points

EPSS probability

Predictive exploitation probability, transformed onto a 20-point curve.

10 points

Exploit maturity

Measures whether exploitation is theoretical, demonstrated or operationalised.

10 points

Exposure potential

Reflects the potential for vulnerable technology to be internet reachable.

5 points

Product prevalence

Recognises the attacker value of products deployed at meaningful scale.

10 points

Technical severity

Uses CVSS for technical impact without allowing it to dominate the Signal.

EPSS transformation20 × √EPSS probability

The square-root curve recognises meaningful probability movement without allowing EPSS alone to dominate verified exploitation evidence.

Published rules

Scoring rules

FactorEvidencePoints

ExploitationConfirmed / credible / suspected / none30 / 20 / 10 / 0

Authoritative statusCISA KEV / ransomware association12 / 3

EPSSProbability from 0 to 120 × √probability

Exploit maturityWeaponised / public / PoC / details / none10 / 8 / 5 / 2 / 0

Exposure potentialHigh / medium / low10 / 6 / 2

Product prevalenceHigh / medium / low5 / 3 / 1

Technical severityCVSS base score0–10

Separate from score

Confidence and freshness

Signal confidence describes the quality, agreement and recency of the supporting sources. It never adds points to the vulnerability score.

High: At least three current sources with no material conflicts.
Medium: At least two sources, updated within 72 hours.
Low: Sparse, stale or materially conflicting evidence.

Deliberate limitation

What the public Signal does not know

Organisational asset criticality is excluded. Only the organisation knows its business importance, data sensitivity, network position, compensating controls, ownership and operational constraints.

Signal is an evidence-led starting point. Your environment determines the final priority.

Worked examples

Why severity is not priority

CVE-2026-12345

Fortinet FortiOS

The combination of confirmed exploitation, KEV inclusion, very high EPSS and an internet-facing edge product makes this an operational priority despite a CVSS score below 9.0.

Exploitation evidence+30
Authoritative status+12
EPSS probability+19.6
Exploit maturity+10
Exposure potential+10
Product prevalence+5
Technical severity+7.5

View evidence

CVE-2026-31704

Adobe Acrobat

The theoretical impact is high, but exploitation probability is very low and there is no KEV or active-exploitation evidence.

Exploitation evidence+0
Authoritative status+0
EPSS probability+1.3
Exploit maturity+0
Exposure potential+2
Product prevalence+5
Technical severity+9.8

View evidence