Severity
Preserve the technical seriousness of the supported finding.
Evidence-aware priority
Turn validation evidence into a defensible fix order.
SecOpsium combines supported technical signals without pretending that one severity label answers every business decision.
Definition
What this capability validates
Severity describes technical seriousness. Exposure describes reachability. Impact describes supported consequences. Priority is the resulting practical order and can change when your team adds stronger context.
Current capability
Exposure
Show whether evidence appears public, restricted, internal, or uncertain.
Impact
Describe supported affected boundaries and keep unknown context visible.
Priority
Produce a practical fix order while leaving room for human judgment.
Scope and Limits
- Priority is a decision aid, not an automated ownership or SLA system.
- Business and architecture context can change the correct order.
- A low priority does not mean zero risk.
Frequently Asked Questions
Is priority the same as severity?
No. Priority combines severity with exposure, supported impact, evidence confidence, and practical urgency.
Does SecOpsium assign findings to owners?
No. The product presents a fix queue but does not currently claim an ownership-assignment workflow.
Can teams override the product's judgment?
Teams should apply stronger business and architecture context when it exists.