RiskBridge动态生成与业务对齐的漏洞修复优先级，提升安全响应效率。
RiskBridge: Turning CVEs into Business-Aligned Patch Priorities
- 融合CVSS v4、EPSS和CISA KEV，用概率模型预测漏洞被利用可能性。
- 实测减少88%残余风险，修复效率提升35%，合规达标提前18天。
- 适合企业安全团队、合规官及需自动化决策支持的运维人员。
企业面临每月数千个新披露的CVE漏洞，传统优先级框架如CVSS提供静态严重性评分，未能考虑漏洞利用概率、合规紧迫性和运营影响，导致修复效率低下。本文提出RiskBridge，一个可解释且符合合规要求的漏洞管理框架，整合来自CVSS v4、EPSS和CISA KEV的多源情报，生成动态、与业务对齐的补丁优先级。RiskBridge采用概率性零日暴露模拟（ZDES）模型预测近期漏洞利用可能性，通过策略即代码引擎将监管要求（如PCI DSS、NIST SP 800-53）转化为自动化SLA逻辑，并使用基于投资回报率的优化器，在每次修复努力中最大化累计风险降低。基于真实漏洞数据集的实验评估表明，相比现有商业基线，该系统实现88%的残余风险下降、18天的SLA合规时间提升以及35%的修复效率增长。结果验证了RiskBridge作为可审计、可解释的决策智能系统的实用性，实现了概率建模、合规推理与优化分析的统一，推动现代企业环境中自动化、可解释、以业务为中心的漏洞管理发展。
原文摘要 · Abstract (English)
Enterprises are confronted with an unprecedented escalation in cybersecurity vulnerabilities, with thousands of new CVEs disclosed each month. Conventional prioritization frameworks such as CVSS offer static severity metrics that fail to account for exploit probability, compliance urgency, and operational impact, resulting in inefficient and delayed remediation. This paper introduces RiskBridge, an explainable and compliance-aware vulnerability management framework that integrates multi-source intelligence from CVSS v4, EPSS, and CISA KEV to produce dynamic, business -- aligned patch priorities. RiskBridge employs a probabilistic Zero-Day Exposure Simulation (ZDES) model to forecast near-term exploit likelihood, a Policy-as-Code Engine to translate regulatory mandates (e.g., PCI DSS, NIST SP 800-53) into automated SLA logic, and an ROI-driven Optimizer to maximize cumulative risk reduction per remediation effort. Experimental evaluations using live CVE datasets demonstrate an 88% reduction in residual risk, an 18-day improvement in SLA compliance, and a 35% increase in remediation efficiency compared to state-of-the-art commercial baselines. These findings validate RiskBridge as a practical and auditable decision-intelligence system that unifies probabilistic modeling, compliance reasoning, and optimization analytics. The framework represents a step toward automated, explainable, and business-centric vulnerability management in modern enterprise environments
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。