Unpacking the Kusari Score
Cut through the noise to prioritize which vulnerability gets fixed next
Parth Patel
Jeff Mendoza
February 13, 2025
.png)
When you have one vulnerability, prioritizing which vulnerability to fix is easy. What happens when you have tens, hundreds, or even thousands of vulnerabilities across your application portfolio? Analysis paralysis can lead to nothing getting fixed. To address this, the Kusari Platform includes a Kusari Score for each identified vulnerability. The Kusari Score provides an easy prioritization method for engineers, product managers, or anyone else who needs to decide what gets fixed next.
What’s in the Kusari Score?
The Kusari Score is a combination of a vulnerability’s severity and how widely-distributed it is in the application portfolio. You can’t look at vulnerabilities one application at a time. Securing your software supply chain works better when you have a holistic view. The more often a vulnerability appears in your dependency graph, the greater the odds that an attacker will be able to exploit it. Therefore, the priority of remediating a vulnerability has to be more than just a measure of technical severity. As we develop the Kusari Platform, we’re working on more ways to provide meaningful context for prioritization.
Of course, the severity matters, too. The Kusari Score uses the industry standard Common Vulnerability Scoring System (CVSS) score. CVSS includes metrics for:
- Attack vector
- Attack complexity
- Attack requirements
- Privileges required
- User interaction
- Vulnerable system confidentiality impact
- Vulnerable system integrity impact
- Vulnerable system availability impact
- Subsequent system confidentiality impact
- Subsequent system integrity impact
- Subsequent system availability impact
Combining these factors into a resulting severity score gives a comprehensive representation of the potential impact of a vulnerability.
How to use the Kusari Score
The Vulnerabilities tab in the Kusari Platform sorts vulnerabilities from highest to lowest Kusari Score by default, so the easiest way to use the Kusari Score is to start at the top of the table and work your way down. Because the Kusari platform integrates into your source code repositories and CI/CD pipelines, this method lets you address the most severe and widespread vulnerabilities first. The Kusari Score is for prioritization, not to objectively rate vulnerabilities. That means the score for a given vulnerability may change as other vulnerabilities are added or removed. The goal is to give you a relative list of what’s most important to fix right now.
The Kusari Score is a starting point. You can further refine your prioritization. For example: you may filter for the vulnerabilities with a “low” effort to fix rating in order to address the low-hanging fruit. This gives your team quick wins and improves your overall security while the developers are working through the more difficult issues.
The Kusari Score comes from our experience in software supply chain security. As the industry matures and new tools and methodologies become available, we continue to fine-tune the Kusari Score methodology. This ensures that the score you see in the Kusari Platform always reflects the best evaluation of a vulnerability’s priority.
Like what you read? Share it with others.
.webp)
.webp)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Previous
No older posts
Next
No newer posts
Want to learn more?