Contextual Vulnerability Scoring for IT Remediation Prioritization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Vulnerability management in computing environments is challenging due to the continually changing nature of organizational systems and limited resources, making it difficult to identify, assess, and remediate vulnerabilities effectively.

Innovation Solution

A vulnerability management application that contextualizes vulnerability data using asset and activity data from the IT environment, allowing users to modify vulnerability scores based on contextual information and provides dashboards for analyzing vulnerabilities from a broad environmental perspective.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional vulnerability management approaches are used to track all vulnerabilities, then comprehensive vulnerability coverage is achieved, but the overwhelming number of vulnerabilities makes effective prioritization and remediation difficult

Engineering Contradiction:

Improvevulnerability assessment accuracyVSAvoidvulnerability management complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent extracts and removes low-priority vulnerabilities from the management workflow by using risk scores to filter out vulnerabilities that pose minimal threat. This allows the system to focus resources on high-impact vulnerabilities while automatically dismissing or deprioritizing those with low business impact, thus reducing the overwhelming complexity of managing all vulnerabilities equally

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies local quality by customizing vulnerability assessment criteria according to specific business contexts, asset criticality, and organizational risk tolerance. Different vulnerability types and severity levels are evaluated with different weights and thresholds based on their local impact on specific business units or systems, rather than applying a uniform assessment standard across all vulnerabilities

Inventive Principle:

Principle #3Local quality

2Reliability

If comprehensive vulnerability scanning is performed across all systems, then complete vulnerability detection is achieved, but resource constraints make continuous monitoring and remediation unsustainable

Engineering Contradiction:

Improvevulnerability detection reliabilityVSAvoidremediation efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the vulnerability management process into distinct phases: detection, risk assessment, prioritization, and remediation. By dividing the comprehensive scanning task into manageable segments and processing them through different operational stages with varying resource requirements, the system maintains reliable detection while improving overall remediation efficiency through structured workflow management

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements feedback loops where vulnerability remediation status, new vulnerability discoveries, and risk score updates continuously inform subsequent scanning and prioritization decisions. This feedback mechanism allows the system to adapt scanning intensity and resource allocation based on current risk levels, maintaining high detection reliability while optimizing resource usage for remediation activities

Inventive Principle:

Principle #23Feedback

3Measurement precision

If vulnerability scores are based solely on technical severity, then objective assessment is achieved, but business context and organizational priorities are not considered

Engineering Contradiction:

Improvevulnerability scoring accuracyVSAvoidrisk assessment adaptability

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent changes the parameters used in vulnerability scoring from purely technical metrics to a composite model that includes business context factors such as asset criticality, data sensitivity, regulatory requirements, and organizational risk tolerance. This parameter transformation allows the same technical vulnerability to receive different risk scores based on the specific business environment, achieving both objective measurement and contextual adaptability

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260052169A1Contextual vulnerability management

Publication Date: 2026.02.19 CISCO TECHNOLOGY INC

AI summary

Techniques are described for providing a software-based platform for context-based vulnerability management of information technology (IT) environments. In some examples, a vulnerability management application collects vulnerability scan data, from potentially many different scanning agents, as well as vulnerability information from other third-party sources. The vulnerability management application also accesses asset and activity data associated with an IT environment. The vulnerability management application can provide a user interface contextualizing vulnerabilities, based on the contextual asset or activity data, allowing for user-configured or automated vulnerability risk adjustments to impact the management and remediation of vulnerabilities for the IT environment.