| Actionable Exploit Assessment System (AEAS) |
Sep 2025 |
Academic paper, Open source on GitHub |
Novel academic research, LLM-based |
| Amazon Inspector Score |
Nov 2021 |
Proprietary |
Commercial, AWS-specific, contextual risk scoring |
| Armis AI Powered Risk Score |
~2020-2024 |
Proprietary, AI |
Commercial, Asset-focused, commercial IoT/OT security |
| Armorcode Risk Scoring |
|
Proprietary |
Commercial |
| Cisco Security Risk Score |
Dec 2023 (rebrand) |
Proprietary |
Cisco-acquired technology (formerly Kenna Risk Score (2021)), commercial |
| Coalition Exploit Scoring System (ESS) |
Jun 2023 |
Public tool, AI/LLM-based |
Adoption primarily by Coalition customers |
| Common Vulnerability Scoring System (CVSS) v2 |
June 2007 |
industry standard |
|
| Common Vulnerability Scoring System (CVSS) V3.1 |
Jun 2019 |
Open standard by FIRST |
Ubiquitous industry standard |
| Common Vulnerability Scoring System (CVSS) V4 |
Nov 2023 |
Open standard by FIRST |
Latest CVSS, growing adoption |
| Common Weakness Scoring System (CWSS) |
2011 |
Open standard by MITRE |
Weakness-focused, limited adoption |
| Damage, Reproducibility, Exploitability, Affected Users, and Discoverability (DREAD) |
2002 |
Book: "Writing Secure Code" 2nd ed |
Deprecated by Microsoft, still used |
| Exploit Prediction Scoring System (EPSS) |
Jan 2021 |
Academic paper, Proprietary Model |
ML-based prediction |
| Lacework FortiCNAPP Risk Score |
Feb 2022 |
Proprietary |
Commercial, Fortinet-acquired, CNAPP-focused |
| Google Attack Exposure Score |
Jun 2023 |
Proprietary |
commercial, GCP-specific, attack path analysis |
| IBM X-Force Threat Score |
~2020 |
Proprietary |
Commercial |
| Ivanti Vulnerability Risk Rating (VRR) |
Apr 2020 |
Proprietary |
Nomenclature standardization, commercial |
| Likely Exploited Vulnerabilities (LEV) |
May 2025 |
NIST white paper CSWP 41, Public |
New NIST guidance, post-exploitation focus |
| Mend Priority Score |
Apr 2021 |
Proprietary |
Commercial |
| Microsoft Exposure Score |
Jun 2019 |
Proprietary |
Commercial, Microsoft ecosystem only |
| NIST Cyber Risk Scoring (CRS) |
Feb 2021 |
NIST internal tool, not public |
NIST internal use, not released |
| Nopsec Risk Score |
~2016-2019 |
Proprietary, ML-based commercial |
Commercial |
| Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) |
Sep 1999 |
CMU/SEI Technical Report, Public |
CMU/SEI framework, enterprise risk |
| Orca Risk Score |
Feb 2024 |
Proprietary |
Cloud-native security, commercial |
| OWASP AI Vulnerability Scoring System (AIVSS) |
Jul 2025 (v0.5) |
Open framework, OWASP project |
AI/ML-specific, very new |
| Phoenix Security |
|
Proprietary |
Commercial |
| Prisma Cloud Risk Score |
Unknown |
Proprietary |
Commercial |
| Process for Attack Simulation and Threat Analysis (PASTA) |
2015 |
Book: "Risk Centric Threat Modeling" |
Threat modeling framework, established |
| Qualys Detection Score (QDS) |
Jun 2022 |
Proprietary |
Commercial, TruRisk component |
| Qualys TruRisk |
Jun 2022 (VMDR 2.0) |
Proprietary, Qualys commercial |
Commercials |
| Rapid7 Active Risk |
Sep 2023 |
Proprietary, threat-aware commercial |
Commercial |
| Recorded Future Risk Score |
|
Proprietary |
Commercial |
| SecScore |
May 2024 |
Academic paper |
Research methodology, academic |
| Social Risk Score (SRS) |
|
|
|
| Snyk Priority Score |
Aug 2020 |
Proprietary, commercial SCA |
Snyk commercial, DevSec focus |
| Stakeholder-Specific Vulnerability Categorization (SSVC) |
2019 |
Open framework, CMU/CISA |
Decision tree approach, growing use |
| Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) |
Late 1990s |
Microsoft SDL framework |
Classic threat modeling, widely used |
| Variable Impact-Exploitability Weightage Scoring System (VIEWSS) |
Apr 2023 |
Academic paper, Research |
Academic research, limited adoption |
| Veracode Security Quality Score |
Pre-2016 |
Proprietary |
Commercial |
| Vulnerability Priority Rating (VPR) |
2019 |
Proprietary, patented by Tenable |
Commercial |
| Vulnerability Impact Scoring System (VISS) |
Mar 2023 |
Open source, GPL 3.0 |
defender-focused |
| Vulnerability Lookup AI (VLAI) |
Jul 2025 |
Open source, GPL 3.0 |
RoBERTA based classifier using English and Chinese corpora (viz the vulnerability databases and advisories CIRCL aggregates) |
| Vulnerability Rating and Scoring System (VRSS) |
2010-2011 |
Academic paper |
Academic research, pre-CVSS v3 |
| VulDB CTI Interest Score / CTI Activity Score |
Unknown |
Proprietary, commercial threat intel |
Commercial |
| Weighted Impact Vulnerability Scoring System (WIVSS) |
2013 |
Academic paper, ACM |
Academic research, limited adoption |