Predictive Exposure and Cryptographic Readiness: A Vendor-Neutral Framework, a, Bounded Multivocal Evidence Analysis, and Reproducible Synthetic Evaluation for SD-WAN Environments

1

Predictive Exposure and Cryptographic Readiness: A Vendor-Neutral Framework, Bounded Multivocal Evidence Review, and Reproducible Synthetic Evaluation for SD-WAN Environments

arXiv:2608.01728v1 [cs.NI] 3 Aug 2026

Saeed Alam School of Computing Sciences and Computer Engineering, University of Southern Mississippi, Hattiesburg, MS, USA

Abstract—SD-WAN teams often use static severity scores to decide what to fix first. These scores do not show live exploitation, network exposure, attack paths, business impact, or cryptographic migration risk. This study asks whether a vendor-neutral PECR framework can produce a different and more traceable ranking than CVSS alone. We reviewed 19 DOI-verified publications from 2020–2026 and five current NIST documents. The review supported ten normalized factors, one weighted score, and a separate confidence measure. We then compared equal-weight PECR with CVSS in five synthetic cases. The tests used Kendall’s 𝜏𝑏 , mean absolute rank shift (MARS), top-three Jaccard overlap (𝐽3 ), factor removal, and bounded weight changes. CVSS ranked the cases A–D–B–E–C. PECR ranked them A–B–E–C–D. The results were 𝜏𝑏 = 0.40, MARS = 1.2, and 𝐽3 = 0.50. The exact 𝜏 test was not significant (𝑝 = 0.483) because the sample had only five cases. The PECR order remained unchanged in 87.5% of 1,024 weight combinations. It also remained unchanged in eight of ten single-factor removal tests. The evidence supports separate measures for severity, exploitation, and organizational context. Evidence for live SD-WAN attack paths and daily PQC triage is still limited. PECR can produce a different and auditable ranking. This synthetic test does not prove better operational results or better human understanding. Index Terms—attack-path analysis, CVSS, EPSS, multivocal evidence review, post-quantum cryptography, SD-WAN, vulnerability prioritization.

bodies provide scoring rules, cryptographic requirements, and migration guidance. PRISMA 2020 guided the transparency checks [1]. However, the available records do not support a PRISMA flow diagram. Software-engineering guidance helped define eligibility [2]. Academic and grey-literature sources were assessed separately [3]. Vendor advisories may explain a product issue, but they do not prove general effectiveness. II. Refined Research Questions The evidence review and framework evaluation address different questions. The review identifies and bounds support for candidate factors. The synthetic evaluation tests calculation mechanics and rank sensitivity. Operational validation still requires comparison on matched vulnerability–asset instances with an external outcome. A. Primary review question PRQ. Which evidence-supported factors, data sources, and measurement methods can be combined into a vendor-neutral model for prioritizing vulnerability remediation in SD-WAN environments? B. Supporting review questions

I. Introduction Vulnerability teams must decide what to fix first while staff time and maintenance windows are limited. CVSS describes technical severity. It does not measure exploitation probability or the effect on a specific asset [4], [12], [13]. In SD-WAN, priority may also depend on Internet exposure, control-plane access, segmentation, business function, and cryptographic dependencies. Past research has not shown how to combine all these signals in one vendor-neutral ranking. PECR combines ten types of information. They cover severity, exploitation, exposure, attack paths, operational impact, and cryptographic readiness. This paper does not claim that ten is the perfect number. Equal weights are used only as a clear baseline for the synthetic test. Real deployments must calibrate weights against measured outcomes. The aim is to define the factors, data sources, rules, and tests without making claims beyond the evidence. This question draws on two types of evidence. Research papers provide methods and measured results. Standards

RQ1. Which static and dynamic factors are used by existing vulnerability prioritization approaches, and how are those factors measured? RQ2. What evidence supports the use of observed exploitation, predicted exploitation, live exposure, and telemetry freshness in remediation decisions? RQ3. How do existing approaches represent attainable privilege, attack-path reachability, lateral-movement potential, blast radius, operational consequence, and systemic concentration? RQ4. Which characteristics of SD-WAN and SASE environments change the meaning or measurement of vulnerability priority? RQ5. How are cryptographic dependencies, crypto-agility, confidentiality lifetime, post-quantum migration urgency, and harvest-now-decrypt-later exposure represented in security decisions? RQ6. Which normalization, weighting, uncertainty, missingdata, confidence, and sensitivity-analysis methods are suitable for a transparent multi-factor prioritization model?

2

C. Framework evaluation question

C. Structured appraisal and extraction

ERQ. When PECR uses the ten selected factors, does it rank the same cases differently from CVSS alone? Which factors cause the changes? Do the rankings remain stable when weights, data age, or missing values change? The ERQ uses the word “traceable” instead of “more explainable.” A traceable score shows its inputs, sources, and factor contributions. This does not prove that analysts understand or trust the score. A separate analyst study is needed before making that claim.

One reviewer used a six-item quality check. It covered source status, method clarity, evaluation evidence, unit relevance, reproducibility, and claim support. Each item received a score from 0 to 2. Total scores of 9–12 were high confidence. Scores of 6–8 were moderate, and 0–5 were limited. We extracted the source type, unit, setting, sample size, data date, factors, comparator, outcomes, uncertainty, and limitations. A second reviewer did not repeat this assessment. The ratings are therefore used to limit claims, not to estimate pooled effects.

III. Contribution and Claim Boundary

D. Ethics and reproducibility The study separates evidence synthesis, framework design, The review used published sources, and the test used scenario evaluation, and external validation. Table I defines what each phase can support. This separation prevents a litera- synthetic values. We did not collect personal data, production ture map or a synthetic demonstration from being presented telemetry, or confidential company data. Human-subject review was therefore not needed for this study. A future analyst or as proof of operational effectiveness. operational study may need institutional approval. It would also need consent, de-identification, access controls, and a IV. Review and Evaluation Method data-management plan. PICOC was used as a coding boundary for the supplied and DOI-expanded evidence corpus (Table II). It kept transferable methods visible while preventing enterprise-security studies E. Synthetic framework evaluation from being treated as direct SD-WAN evidence. PECR and CVSS ranked the same five synthetic vulnerability– asset instances. Rank divergence was measured with Kendall’s 𝜏𝑏 , mean absolute rank shift (MARS), and top-k Jaccard overlap A. Eligibility, time, and source boundaries (𝐽 𝑘 ). Equations (1) and (2) define the latter two measures, where The bounded corpus contains English-language topical publir is rank position and T is the set of top-k instances. cations dated 2020–2026 that were supplied in the source CSV or added through DOI-led citation expansion. Methodological 𝑛 1 ∑︁ PECR guidance and current standards were retained separately from MARS = 𝑟 − 𝑟 𝑖CVSS (1) the 19 topical publications so they did not inflate the empirical 𝑛 𝑖=1 𝑖 evidence count. Journal and conference publications, a preprint, a technical paper, and authoritative NIST publications were 𝑇 PECR ∩ 𝑇𝑘CVSS coded as separate source types. Only English-language records 𝐽 𝑘 = 𝑘PECR (2) were reviewed; this restriction limits geographic and linguistic 𝑇𝑘 ∪ 𝑇𝑘CVSS coverage. Standards and guidance were checked for publication status and version on 29 July 2026; time-sensitive sources The test compared every pair of cases and removed one require another check immediately before submission. factor at a time. It also tested all 1,024 weight combinations made by changing each weight by ±20% and then normalizing the weights. A different ranking does not mean a better ranking. B. Evidence identification and selection The synthetic cases have no external outcome. They cannot The evidence set began with eight DOI records from the prove avoided loss, better exploit prediction, useful remediation, supplied CSV. DOI checks and citation searches added eleven or faster risk reduction. We assessed traceability only through non-duplicate studies. This produced 19 topical publications. complete records and visible score components. We checked each DOI and used the publisher page or an author manuscript when available. We also added five NIST documents for cryptographic readiness. They were FIPS 203, V. Literature Synthesis from the DOI-Verified Corpus FIPS 204, FIPS 205, NIST IR 8547 Initial Public Draft, and NIST CSWP 39upd1 [23]–[27]. The source files did not include The supplied CSV contained eight studies published from a database search log or initial retrieval totals. They also did 2022 to 2026. DOI checks and citation searches added eleven not include duplicate counts, full-text exclusions, or a second- studies from 2020 to 2026. We checked each reference through reviewer record. We did not reconstruct these numbers. For this its DOI. We also checked important claims against a publisher reason, the paper reports a bounded multivocal review rather page or author manuscript when available. The final set contains than a complete PRISMA review. This wording makes clear 19 studies, but it is not exhaustive. It supports framework design, that the 19-study set is not exhaustive. not a complete PRISMA review.

3

TABLE I Contribution and Claim Boundary Phase

Produces

Supports

1. Bounded review

Evidence map; factor taxonomy; measurement and evaluation methods; gaps 2. Framework design Ten-factor model; definitions; normalization; confidence and missing-data rules 3. Scenario evaluation CVSS and PECR rankings; rank metrics; ablation and sensitivity results 4. External validation Operational datasets, analyst assessments, and longitudinal outcomes

Does not establish

A traceable rationale for selecting or rejecting That PECR improves real remediation outcomes candidate PECR factors A reproducible and vendor-neutral research artifact Empirical validity or optimal weights Feasibility, internal consistency, rank difference, and decision traceability Claims about usefulness, calibration, and human explainability

Field effectiveness or generalizability when the data are synthetic Part of the present review unless such data are collected

TABLE II PICOC Definition for the PECR Review Element

Definition

Operational scope

Population

Vulnerabilities and affected assets in SD-WAN, SASE, SDN, and closely transferable enterprise-network environments

Intervention

Context-aware vulnerability prioritization

Comparison

Severity-only and other baseline ranking methods

Outcomes

Evidence needed to design and assess a prioritization model

Context

Vendor-neutral enterprise remediation decisions

Controllers, orchestrators, management services, branch edges, gateways, identity services, segmentation controls, and cryptographic dependencies. General endpoint-only studies are included only when their method is transferable. Methods may use severity, exploitation evidence, probability, exposure, privilege, reachability, attack paths, blast radius, consequence, concentration, or cryptographic readiness. CVSS-only ranking is the primary baseline. EPSS-, KEV-, SSVC-, asset-criticality-, and attack-graph-based approaches are secondary comparators when reported. Factor definitions; data sources; normalization; weights; uncertainty; missing-data rules; rank changes; decision traceability; sensitivity; reproducibility; and operational limitations. Distributed branch networks with centralized policy or control, direct Internet exposure, segmentation, and cryptographic trust dependencies. Product-specific evidence may inform a mechanism but cannot define the framework.

A. Severity and exploitation are related but distinct signals

Iannone et al. tested 72 early exploit-prediction settings and five pretrained language models [15]. They used early CVE Tan et al. found no clear correlation between CVSS severity descriptions and linked discussions. In the time-aware test, CVE and EPSS probability [4]. The two measures represent different descriptions and SecurityFocus discussions gave the most useful constructs: potential technical impact and predicted exploitasignals. Pretrained language models performed poorly without tion. PECR should preserve that distinction and treat exploit added security training. PECR should treat early predictions probability as a dated, time-varying input. as uncertain evidence, not as proof of exploitation. Jacobs et al. presented EPSS as an open, data-based estimate Shimizu and Hashimoto tested a two-stage process [5]. It first of exploit probability [12]. Their 2021 model predicted exploitaused KEV membership or an EPSS threshold, and then applied tion during the first 12 months after disclosure and reported a CVSS threshold. Their test covered 28,377 vulnerabilities and ROC AUC = 0.838. Later EPSS versions use a 30-day period reported AUC = 0.8678. At an EPSS threshold of 0.088, the [13]. A PECR record should store the model version, date, true-positive rate was 48.89%. The reported workload reduction score, and percentile. A score without this time information was 96.9%, but the classes were highly imbalanced. This result can be misleading. shows an important trade-off. A smaller urgent queue may still Koscinski et al. compared CVSS, EPSS, SSVC, and the miss exploited vulnerabilities. Exploitability Index for 600 Microsoft Patch Tuesday vulnerabilities [13]. Agreement between the systems was weak. Only five vulnerabilities appeared in every top-100 list. Large groups B. Organizational context changes remediation order of tied scores also reduced ranking value. The study shows that Ahmadi Mehri, Arlos, and Casalicchio built a context-aware accepted systems can produce very different orders. It does not method [6]. Organizations choose the criteria and weights based show that combining them always gives a better result. PECR on their risk needs. The test produced different remediation must test its combined ranking against an external outcome. orders when those choices changed. Local context can therefore Allodi et al. studied CVSS v3 ratings from 73 people change priority. However, local weights must be documented, across 30 vulnerabilities [14]. People with security knowledge reviewed, and tested for sensitivity. were 30%–60% less likely to make an error than untrained Dubey and Maity combined semantic representations with participants. Experienced professionals did not show a clear asset importance, exposure, and exploitation likelihood [7]. advantage over security-focused students. This result shows They assessed the remediation order with Mean Reciprocal that CVSS includes important human judgment. PECR should Rank and Recall@K instead of relying only on classification show the source, confidence, and missing-data status for each accuracy. Those measures match PECR’s intended output: assessed value. an ordered queue. Source attribution and decomposed score

4

components also improve auditability, although they do not establish human comprehension. Agyei et al. combined CVSS, EPSS, KEV, asset criticality, Internet exposure, and compensating controls in a weighted hybrid-cloud model [8]. Because the evaluation used simulated data, the reported reductions in urgent work are scenario results rather than evidence of field effectiveness. The study’s relevant design features are factor-level contributions, rulebased overrides, and audit-readable decision records. C. Threat context is useful only when mappings are complete Shreyas and Arun Kumar integrated CVSS, EPSS, and MITRE ATT&CK in static and adaptive models [9]. EPSS carried the strongest learned weight, whereas ATT&CK contributed little or received a negative weight when mappings were sparse. A conceptually attractive factor should not receive a large weight when coverage is poor. PECR should measure coverage, freshness, and mapping confidence separately from the factor value. Anwer and Ali analyzed 1,577 KEV records across 257 vendors using exploitation volume, ransomware association, and remediation delay [10]. They reported Spearman correlations above 0.96 across alternative weight settings. The analysis supports observed-exploitation signals and formal sensitivity testing, but its principal unit is the vendor. PECR must rank a vulnerability on a specific asset and attack path. Sri’s practitioner framework combines CVSS, EPSS, KEV, and IT asset-management context for small and medium-sized enterprises [11]. Its implementation guidance is relevant, but the stated workload reduction is an estimate rather than a reproduced experiment. The source should remain in the greyliterature stratum and should not carry the same evidentiary weight as a peer-reviewed evaluation. Briliyant et al. applied live EPSS values and an SSVC decision tree to 14 IoT vulnerability cases [16]. They identified three cases requiring immediate attention that a static method missed. The sample is small and outside SD-WAN, and the abstract reports internally inconsistent percentages. This review therefore retains the count but not the disputed percentages. Chhillar et al. proposed a two-stage risk-scoring engine [17]. It combines CVSS, EPSS, KEV, threat intelligence, and internal telemetry. The first stage predicts exploitability. The second stage creates a contextual score. The design is relevant to PECR. However, the six-page paper does not provide enough evaluation detail to confirm its claimed alert reduction. Moraghebi and Ali analyzed more than 1,600 CISA KEV records and separated ransomware-linked vulnerabilities from the broader exploited set [18]. The ransomware-linked records showed concentrated vendor exposure, greater operational urgency, and changing remediation windows. These findings motivate a separate consequence signal, but the study examines catalog, vendor, and temporal patterns rather than asset-specific SD-WAN impact. Yu et al. studied vulnerability co-exploitation with a large knowledge graph [19]. The graph had more than 355,000 nodes and four million links. Their model predicts vulnerabilities that may be exploited together. This supports a separate dependency

factor. It does not measure live reachability, attainable privilege, or lateral movement in an SD-WAN network. D. AI integration, process context, and cross-domain transferability Siewruk and Berej reviewed generative and learning models across code, binary, dependency, graph, and deployment representations [20]. Their risk-aware model combines likelihood, exposure, and impact while emphasizing guardrails, retained evidence, triage time, developer acceptance, and change-failure rate. These are useful adoption measures. As a review and design overview, however, the article is not independent evidence that a particular scoring model improves outcomes. Lysetskyi frames vulnerability management as a continuous sequence of detection, normalization, prioritization, remediation, verification, and reporting [21]. The paper argues that scanners and CVE records are necessary but insufficient without environmental context, predictive models, and threat analytics. It provides process background, not comparative evidence for a weighting formula. Oka and Vadamalu examine CVSS, EPSS, and SSVC in software-defined vehicles, where external connectivity and software complexity expand the attack surface [22]. Their lifecycle perspective is transferable to software-defined network edges. The automotive setting cannot establish SD-WAN factor values, but it reinforces the distinction among severity, predicted exploitation, and mission context. E. Evidence map and remaining gap

SSRN practitioner preprint Peer-reviewed foundational EPSS article ACM CCS study; 600 Patch Tuesday CVEs Journal experiment; 73 assessors, 30 CVEs Journal time-aware prediction study IEEE conference; 14 IoT cases

Six-page IEEE conference framework Journal analysis; more than 1,600 KEV records IEEE knowledge-graph experiment Peer-reviewed IEEE Access review Journal process overview SAE technical paper; automotive attack analysis

[11] Sri, 2026 [12] Jacobs et al., 2021 [13] Koscinski et al., 2025 [14] Allodi et al., 2020 [15] Iannone et al., 2024 [16] Briliyant et al., 2025

[17] Chhillar et al., 2025 [18] Moraghebi & Ali, 2026 [19] Yu et al., 2025 [20] Siewruk & Berej, 2026 [21] Lysetskyi, 2026 [22] Oka & Vadamalu, 2026

[7] Dubey & Maity, 2026

Journal article using simulated hybrid-cloud data

Peer-reviewed IEEE conference learning-to-rank study

[6] Ahmadi Mehri et al., 2022

Peer-reviewed IEEE conference adaptive model Journal analytics study; 1,577 KEV records and 257 vendors

Journal prototype and scenario comparison

[5] Shimizu & Hashimoto, 2026

[9] Shreyas & Arun Kumar, 2025 [10] Anwer & Ali, 2026

Peer-reviewed IEEE Access evaluation; 28,377 vulnerabilities

[4] Tan et al., 2025

[8] Agyei et al., 2026

Evidence basis

Peer-reviewed IEEE conference analysis

Study

CVSS, EPSS, KEV, threat intelligence, telemetry Ransomware, vendor exposure, remediation windows Co-exploitation, semantic and structural links AI models, likelihood, exposure, impact, guardrails Context, predictive analytics, continuous VM cycle CVSS, EPSS, SSVC, mission context

CVSS, EPSS, KEV, ITAM asset context Exploit probability; historical 12-month horizon CVSS, EPSS, SSVC, Exploitability Index CVSS accuracy, expertise, confidence Initial CVE text, discussions, ML, LLMs Live EPSS, SSVC, exploitation status

CVSS, EPSS, ATT&CK mappings KEV, ransomware association, remediation delay

CVSS, EPSS, KEV, criticality, exposure, controls

Asset importance, exposure, exploit likelihood, semantic context

Organizational weights, risk appetite, vulnerability age

KEV, EPSS, CVSS thresholds

CVSS, EPSS, score movement

Primary signals

TABLE III DOI-Verified Corpus and Its Bounded Contribution PECR contribution and limit Supports separating severity from exploitation likelihood; no asset, topology, or operational context. Strong multi-signal triage evidence; threshold trade-offs remain; no live network telemetry or cryptographic factor. Supports context-specific ordering; locally selected weights require governance and sensitivity testing. Supports ranking metrics and decomposed evidence; general enterprise scope, not SD-WAN-specific. Useful transparent design pattern; simulated outcomes do not establish field effectiveness or human explainability. Shows the effect of sparse threat mappings; factor value depends on coverage and data quality. Supports operational exploitation signals and sensitivity analysis; vendor-level output differs from PECR’s vulnerability-asset unit. Provides adoption guidance; estimated results and no peer-review status limit evidentiary weight. Supports a separate predictive signal; model version and horizon must be recorded. Direct rank-divergence evidence; weak agreement warns against unvalidated score fusion. Shows assessor-dependent variance; supports provenance and confidence fields. Supports early prediction with uncertainty; pretrained LLM performance was limited. Shows cross-domain rank changes; small sample and inconsistent abstract percentages limit inference. Relevant telemetry architecture; accessible evidence is insufficient for effectiveness claims. Supports operational consequence; catalog/vendor analysis is not asset-level validation. Supports multi-CVE dependency analysis; does not measure live network attack paths. Useful adoption and audit measures; secondary evidence, not independent validation. Provides process background; no comparative ranking evaluation. Transferable software-defined edge analogy; not direct SD-WAN evidence.

5

6

Six design needs appeared across the 19 studies. Severity and exploit likelihood should remain separate. Predictive scores need a version and date. Confirmed exploitation should trigger urgent review. Asset, mission, and operational context should affect priority. The model should also show multi-vulnerability links, data sources, and confidence. Existing scoring systems can produce very different rankings. However, the evidence does not validate SD-WAN attack paths, lateral movement, control-plane concentration, or telemetry-age rules. It also does not validate a C-BOM or daily post-quantum migration score. Finally, the studies do not prove that ten factors or one weight set is best.

Directness: No included study validates vulnerability prioritization on an operational SD-WAN or SASE dataset. All 19 topical publications are transferred from general vulnerability management, enterprise or hybrid cloud, IoT, automotive, software engineering, or threat-knowledge settings. Study design: 14 records report an empirical, prototype, case, analytics, or simulated evaluation; five are review, framework, process, practitioner, or technical treatments. The five NIST records define standards or transition guidance. Coverage: Topical publications span 2020–2026. Sectors include enterprise IT, hybrid cloud, IoT, automotive systems, and cross-domain vulnerability management; geographic representativeness cannot be inferred from this corpus.

VI. Bounded Review Results Evidence limit. The available sources support a structured review with checked DOIs. They do not support reconstructed PRISMA counts, exhaustive coverage, or reviewer-agreement statistics. The results in this section apply only to the 19 studies and five NIST documents described in Section IV.

C. Quality appraisal and confidence in the evidence

The quality check limited how each source could support a factor, threshold, weight, or effectiveness claim. We report confidence by source type. We also checked whether the main conclusions changed after removing limited-confidence sources. Appraisal method: A retrospective six-item, 0–12 rubric A. Evidence identification and corpus boundary assessed source status, methodological transparency, evaluation The evidence set was assembled through supplied records, evidence, unit relevance, reproducibility, and claim support. DOI resolution, and citation-led expansion. Counts that were The rubric was not preregistered or independently piloted. not present in the source files are reported as unavailable rather Confidence distribution: Seven studies were high confidence than inferred. [5], [6], [12]–[15], [19]. Eight were moderate [4], [7], [9], [10], Registration: None. The review was completed retrospectively [16], [18], [20], [22]. Four were limited [8], [11], [17], [21]. as a bounded evidence synthesis and is not presented as a These ratings only control how the sources are used in this preregistered SLR. paper. They are not rankings of journal quality. Evidence-status date: DOI identities and current NIST publi- Use after appraisal: No record was removed from qualitative cation status were checked through 29 July 2026. design synthesis. Limited-confidence records were used only Identification: Eight supplied DOI records plus eleven DOI- for architecture, process, or implementation context and not to led additions produced 19 topical publications; five NIST justify effect sizes, thresholds, or weights. publications were added as a separate standards stratum. Sensitivity: Removing the four limited-confidence studies did Duplicate and exclusion counts: Unavailable because no not change the main findings. Severity and exploitation remain database export or screening log was supplied. No count is different, context changes order, and source information still reconstructed. matters. The removal only reduces support for automation and Included corpus: 19 topical publications were retained for implementation workflow. design synthesis; 27 total references include three reviewmethod sources and five NIST publications. Full-text exclusions: Not reportable from the available records. D. Final synthesis by research question Abstract-only limitations are identified in the evidence synthesis The next part answers each research question. It separates where applicable. direct SD-WAN evidence, transferred evidence, and standardsReviewer agreement: Not applicable. One reviewer performed based requirements. It also notes agreement, disagreement, and the evidence audit; no independent screening or adjudication measurement limits. A factor remains in the model only when record exists. its meaning, input, scale, age, confidence, and use can be stated PRISMA diagram: Intentionally omitted. A flow diagram clearly. would imply retrieval and screening data that were not collected. RQ1: The study keeps ten factors in the research model: B. Included-source characteristics We summarized the studies by year, source type, setting, design, unit of analysis, comparator, and outcome. Primary studies, reviews, and official guidance were kept separate. This avoids counting the same evidence twice. Evidence composition: 19 topical publications: 17 journal or conference papers, one SSRN preprint [11], and one SAE technical paper [22]. Five NIST standards or guidance publications form a separate authoritative stratum [23]–[27].

severity, predicted exploitation, observed exploitation, exposure, reachability, privilege, blast radius, consequence, concentration, and cryptographic readiness. Vendor name and vulnerability age are metadata, not risk factors. The same applies to data age, confidence, and whether AI produced a value. RQ2: Confidence is high that severity, predicted exploitation, and observed exploitation are different constructs [4], [5], [12], [13], [15]. Evidence for external exposure is moderate and transferred; direct evidence for telemetry-freshness decay in SD-WAN is limited.

7

RQ3: Operational consequence has moderate cross-domain support, and co-exploitation evidence supports modeling dependency [18], [19]. Direct SD-WAN evidence for live reachability, attainable privilege, lateral movement, blast radius, and controlplane concentration is absent; those factors remain provisional. RQ4: Controller or orchestrator centrality, direct Internet access, segmentation paths, shared management services, and cryptographic trust dependencies plausibly change priority. Confidence is low because the included studies do not test these modifiers in an operational SD-WAN environment. RQ5: FIPS 203, 204, and 205 define the current PQC algorithm standards [23]–[25]. NIST transition and cryptoagility guidance supports a limited C-BOM and migration record [26], [27]. Evidence is strong for inventory and transition planning. It is weak for a daily triage weight or a numeric HNDL score. RQ6: The selected baseline is a transparent additive 0–100 score with normalized inputs, published weights, and a separate completeness/confidence measure. Equal weights are used only for the synthetic benchmark. Opaque learned weights, silent renormalization around missing factors, and confidencemultiplied scores are rejected for the baseline. E. Review-stage decision Review decision. The sources support ten distinct ideas, but not ten equally tested predictors. Severity, predicted exploitation, observed exploitation, exposure, and consequence form the first operational layer. Reachability, privilege, blast radius, and concentration need mature topology data and direct SD-WAN testing. Cryptographic readiness can be added when a reliable C-BOM exists. This paper differs from the original SLR plan. It uses a bounded review because no reproducible database search and screening log was available. VII. PECR Framework Specification PECR ranks a vulnerability on a specific asset at a specific time. It does not rank a CVE by itself. Each record identifies the vulnerability, affected asset or service, SD-WAN role, and data time. The output includes a priority score, confidence value, factor details, and any escalation flag. This prevents teams from reusing a score for a different asset or time without review. A. Scope boundary PECR is narrower than a general cyber-risk platform. It orders remediation for flaws in SD-WAN controllers, orchestrators, management services, branch edges, and gateways. It also covers identity services, segmentation controls, and cryptographic trust chains. In scope: Technical severity, predicted and observed exploitation, exposure, reachability, privilege, blast radius, operational consequence, concentration, and cryptographic readiness. In scope: Vendor-neutral inputs derived from open standards, normalized telemetry fields, topology models, public catalogs, and bounded organizational context.

Out of scope: Automatic patching, exploit creation, unsupported zero-day prediction, full enterprise risk measurement, and proof of cryptographic security. Out of scope: Vendor product scoring, replacement of changecontrol approval, and claims of human explainability without an analyst study. B. Ten-factor research specification Table IV defines the ten factors for research use. Evidence strength decides when a factor can be adopted. It does not change the factor’s 0–1 scale. Each value keeps its source, time, conversion rule, and confidence value.

8

TABLE IV Ten-Factor PECR Research Specification No.

Factor

1

Technical severity

2 3 4 5 6 7 8 9 10

Normalized input

Evidence and freshness

CVSS Base score divided by 10, with version and vector retained. Predicted exploit likeli- Versioned EPSS probability or a validated hood alternative on [0, 1] . Observed exploitation Confirmed catalog or internal evidence; distinguish confirmed, absent, and unknown. External exposure Reachable service exposure, ingress path, or authenticated external access. Attack-path reachability Normalized existence, length, and control strength of a path to the affected service. Attainable privilege Highest credible privilege or control-plane authority gained after exploitation. Normalized number and criticality of reachable Blast radius segments, tenants, or dependent services. Mission, safety, confidentiality, integrity, Operational consequence availability, and recovery consequence. Systemic concentration Control-plane centrality, shared dependency, or single-point-of-failure concentration. Cryptographic readiness Urgency from quantum-vulnerable use, confidentiality lifetime, migration lead time, and crypto-agility.

NVD/vendor record; update on vector revision. Core—direct evidence Model version, score date, percentile, horizon.

10 ∑︁

𝑤 𝑗 𝑥𝑖 𝑗 (𝑡),

𝑤 𝑗 ≥ 0,

Exploit preconditions, IAM role, service account, device role. Segmentation graph and dependency map.

Stage 2—provisional

Business impact analysis and service tier.

Core—direct evidence

Architecture inventory and dependency centrality. C-BOM, standards status, protocol inventory, retirement plan.

Stage 2—SD-WAN hypothesis

10 ∑︁

𝑤 𝑗 𝑐 𝑖 𝑗 (𝑡)

Stage 2—provisional

Stage 3—standards led

(3)

Escalation: Confirmed exploitation creates an urgent-review flag. A control-plane asset also escalates when exposure, reachability, and consequence are each at least 0.80. Lowconfidence cases are routed for evidence collection rather than silently down-ranked. The model owner approves rule changes; security operations records case-level overrides and rationale.

(4)

D. Cryptographic Bill of Materials and PQC readiness

𝑤𝑗 = 1

𝑗=1

𝑗=1

𝐶𝑖 (𝑡) =

10 ∑︁

Core—direct evidence

KEV, incident, honeypot, EDR/SIEM; Core—direct evidence time-stamped. Flow, firewall, NAT, proxy, and asset data; Core—transferred evidence decay by age. Topology and policy graph; recompute on drift. Stage 2—provisional

The base calculation is transparent:

PECR𝑖 (𝑡) = 100

Status

𝑗=1

The limited C-BOM records where public-key cryptography is used. It stores the algorithm, parameters, key and certificate lifetimes, protocol, data lifetime, owner, replacement path, and migration time. FIPS 203 defines ML-KEM for key establishment [23]. FIPS 204 and FIPS 205 define ML-DSA and SLH-DSA for signatures [24], [25]. NIST IR 8547 is still an Initial Public Draft on the manuscript date [26]. Its transition dates must be described as proposed, not final. NIST guidance also explains how an organization can change algorithms while C. Weighting, normalization, and missing data keeping systems secure and available [27]. Weights are policy choices, not universal facts. This paper Cryptographic readiness is not a simple yes-or-no PQC uses equal weights only as a clear and repeatable baseline. A field. The score should increase when vulnerable cryptography real deployment must test weights against an external outcome. protects long-lived confidential data. It should also increase Every result should report the exact weights, tested range, when many branches share the same dependency or when and rank stability. Any threshold or nonlinear rule needs an algorithms are hard to replace. The score should decrease only operational reason and a factor-removal test. when the inventory is current and a migration path has been Benchmark weights: 𝑤 1 through 𝑤 10 are each 0.10. This tested. Any scoring rule must record the version and status vector is an uncalibrated neutral baseline for the synthetic of each standard. It must also be tested against an external evaluation, not a recommended operational default. outcome. Missing data: Preserve unknown status and calculate lower and upper score bounds by assigning the missing normalized value 0 and 1. Do not treat unknown as zero or renormalize silently. E. Decision traceability and vendor neutrality Suppress an autonomous rank when weighted completeness C A PECR record should show the case ID, factor values, is below 0.70. weights, sources, dates, conversions, confidence, missing fields, Freshness: Keep the observed value, but reduce confidence as overrides, score, and rank. Vendor neutrality is tested through data become old. Use 𝑐 = max(0, 1 − age/𝐿). Set L to 7 days the data schema. Two different implementations must fill the for EPSS and 24 hours for exposure or topology data. Set L same logical fields without changing their meaning. Product to 90 days for C-BOM records. An approved local policy may APIs may provide data, but they may not define what the data use shorter periods. mean. Equation (3) gives a priority score from 0 to 100. Equation (4) reports confidence and completeness as a separate value. PECR must not hide weak data by multiplying confidence into the score. It must also avoid silently changing weights when data are missing. The system should show the score, confidence, missing fields, and overrides together.

9

VIII. Evaluation Design and Worked Example The evaluation has two limited goals. First, it checks whether PECR changes the CVSS order for the same synthetic cases. Second, it checks whether the calculation is traceable and stable under small weight changes. A later study must test operational value. A rank change alone is not an improvement. A. Hypotheses and success criteria H1: PECR and CVSS produce materially different rankings on matched SD-WAN instances, measured with Kendall’s 𝜏𝑏 , MARS, and top-k Jaccard overlap (𝐽 𝑘 ). H2: PECR improves a stated external outcome. Examples include precision@𝑘 for exploitation, expert priority, avoided loss, or time to risk reduction. H3: PECR produces a more complete decision trail, measured as the proportion of instances with reproducible inputs, timestamps, confidence, and factor contributions. H4: The top-k queue remains acceptably stable under plausible changes in weights, telemetry age, and missing-data assumptions. Exploratory thresholds: This example was not preregistered, so the thresholds are descriptive. H1 is met when MARS ≥ 1.0 or 𝐽3 ≤ 0.67. H2 needs a better external outcome and cannot be tested here. H3 needs a complete factor record for every case. H4 needs the same top-three set in at least 80% of the ±20% weight combinations. B. Synthetic evaluation corpus and boundary Evaluation limit. The test contains five synthetic vulnerability–asset cases. They are enough to check the calculations, ranking changes, score details, and limited sensitivity. They are not production telemetry or a representative SD-WAN sample. They also do not provide external validation. Topology: Five archetypes represent a controller, branch edge, orchestrator dependency, branch web interface, and management plane. No live graph or vendor implementation is used. Vulnerability–asset instances: 𝑛 = 5 synthetic cases, labeled A–E. All ten factor values are present; there are no duplicates or exclusions. Telemetry: Exposure, path, privilege, blast-radius, and concentration values are scenario assignments. They are not measured IPFIX, NetFlow, event-log, routing, authentication, firewall, or proxy observations. External criterion: None. The benchmark cannot test exploitation prediction, avoided loss, analyst priority, remediation outcome, or time to risk reduction. Data governance: No personal, confidential, or organizational data are present. The complete synthetic matrix is published in Table V. Comparator: The normalized technical-severity factor provides the CVSS-only order. Other factor values are fixed synthetic inputs and must not be interpreted as live EPSS or KEV snapshots.

C. Synthetic worked example The five-case example shows how PECR can change a remediation queue. It uses equal weights of 0.10 only to check the calculation. All values are synthetic. A zero for observed exploitation means “not listed in this example.” It does not prove that exploitation has never occurred. A real system must keep unknown status and confidence. A Internet-reachable SD-WAN controller remote-codeexecution flaw. B Branch-edge command-injection flaw with confirmed exploitation. C Orchestrator cryptographic dependency with longlived confidentiality and slow migration. Branch web-interface flaw with high CVSS but limited D privilege and blast radius. Management-plane authentication bypass with strong E path and concentration effects. CVSS orders the instances A, D, B, E, C. Equal-weight PECR orders them A, B, E, C, D. Table VI shows the resulting rank movement.

10

TABLE V Synthetic Ten-Factor Input Matrix Factor

Weight

A

B

C

D

E

Technical severity (TS) Predicted likelihood (PL) Observed exploitation (OE) External exposure (EX) Attack-path reachability (AR) Attainable privilege (AP) Blast radius (BR) Operational consequence (OC) Systemic concentration (SC) Cryptographic readiness (CR) PECR score from Equation (3)

0.10 0.10 0.10 0.10 0.10 0.10 0.10 0.10 0.10 0.10 —

0.98 0.92 1.00 0.90 0.95 0.90 0.95 1.00 1.00 0.20 88.0

0.88 0.65 1.00 1.00 0.80 0.75 0.65 0.80 0.70 0.40 76.3

0.75 0.05 0.00 0.40 0.65 0.60 0.85 0.95 1.00 0.95 62.0

0.90 0.08 0.00 0.70 0.25 0.20 0.10 0.30 0.10 0.00 26.3

0.81 0.35 0.00 0.60 0.90 1.00 0.90 0.90 0.90 0.10 64.6

TABLE VI Synthetic CVSS–PECR Rank Comparison ID Scenario A B C D E

Controller RCE Exploited branch-edge injection Orchestrator crypto dependency Limited branch web flaw Management-plane auth bypass

CVSS rank PECR rank |Shift| 1 3 5 2 4

1 2 4 5 3

0 1 1 3 1

For this example, MARS = (0 + 1 + 1 + 3 + 1)/5 = 1.2 A. Dataset and execution summary positions. The top-three lists share A and B, so 𝐽3 = 2/4 = 0.50. The test has five synthetic cases and five SD-WAN role Seven pairs agree and three disagree. With no ties, Kendall’s types. All 50 factor values are present, so missingness is 0%. 𝜏𝑏 = (7 − 3)/10 = 0.40. There are 5! = 120 possible orders. There is no collection period, branch count, production site, The exact two-sided p-value for |𝜏| ≥ 0.40 is 58/120 = 0.483. or excluded case. Tables V and VI, Equations (1)–(4), and the The result meets the descriptive threshold. However, five cases weight rule define the full calculation. cannot support a significant result or a claim of operational value. B. Ranking divergence D. Reproducible evaluation procedure

CVSS ranked the cases A–D–B–E–C. PECR ranked them A–B–E–C–D. Kendall’s 𝜏𝑏 was 0.40 with no ties, and the exact two-sided p-value was 0.483. Rank shifts were 0, 1, 1, 3, and 1. MARS was 1.2, the median shift was 1, and the largest shift was 3. 𝐽3 was 0.50. Case D fell from second to fifth. Its high severity was balanced by low reachability, privilege, blast radius, consequence, and concentration.

1) Freeze the vulnerability, asset, topology, telemetry, CVSS, EPSS, KEV, C-BOM, and external-outcome snapshots; record versions and hashes. 2) Apply the final normalization and missing-data rules without viewing the outcome labels. 3) Compute CVSS and PECR ranks on the same instances and retain decomposed score records. 4) Report Kendall’s 𝜏𝑏 , MARS, top-k Jaccard (𝐽 𝑘 ), confi- C. External outcome and operational utility dence intervals, tie handling, and rank-change explanaNo external outcome or secondary operational baseline tions. exists for the synthetic corpus. H2 is therefore not tested. The 5) Test external outcome performance with prespecified results cannot establish improved precision, avoided loss, lower metrics and compare against CVSS and secondary workload, faster remediation, or fewer false negatives. The baselines. only supported claim is rank divergence under transparent 6) Run ablation, weight, freshness, and missing-data sensi- assumptions. tivity analyses; report every setting. 7) If the paper claims human explainability, run a separate approved analyst study. Measure understanding, trust, D. Traceability, ablation, and sensitivity decision time, and decision quality. All five synthetic records are complete and show every score component. The base order stayed the same in eight of ten IX. Synthetic Evaluation Results single-factor removal tests. Removing predicted likelihood or Result limit. These results apply only to the synthetic matrix privilege changed the middle order to A–B–C–E–D. Doubling and equal-weight model. They show that PECR can produce a one factor kept the base order in nine of ten tests. Doubling different and traceable order under stated assumptions. They cryptographic readiness moved C above E. The exact order do not show better real-world remediation. and top-three set stayed the same in 87.5% of the 1,024 weight

11

combinations. In the other cases, 𝐽3 fell to 0.50. We did not test old or missing telemetry because the matrix is static and complete. E. Final answer to the evaluation question Answer to the ERQ. Yes. Equal-weight PECR produced a different ranking from CVSS in the five cases. The results were 𝜏𝑏 = 0.40, MARS = 1.2, and 𝐽3 = 0.50. The score is computationally traceable because every factor, weight, and assumption is visible. The test does not show better operational results or better human understanding. The finding applies only to the complete synthetic matrix and the tested weight range. X. Adoption and Governance Model PECR should be used as a managed decision process, not as a one-time score. An organization can start with asset inventory and clear decision records. It can then add live exposure, topology, cryptographic dependencies, and outcomebased calibration. Table VIII presents these steps without requiring full telemetry on the first day. A. Governance and operational controls Model owner: Approves factor definitions, weights, thresholds, missing-data rules, and version changes. Data owners: Attest to asset, telemetry, topology, businessimpact, and C-BOM coverage and freshness. Security operations: Reviews the queue, records overrides and rationale, and reports remediation outcomes. Change advisory authority: Decides remediation timing when operational risk conflicts with vulnerability urgency. Independent assurance: Reproduces sample decisions, audits evidence provenance, and reviews drift and bias. Adoption measures should cover inventory, missing factors, data age, rank stability, and override rate. They should also cover decision time, SLA results, urgent-queue size, missed priorities, and analyst acceptance. Each evaluation must use one fixed model version. Important model changes require a new validation. B. Vendor-neutral implementation test A system is vendor-neutral only when factor meanings stay the same across data adapters. Testing should use the same schema with at least two SD-WAN or similar network products. The test should compare missing data and conversion rules. It should also list any field that depends on a proprietary feature. A vendor incident may inform one case, but it cannot define a universal factor. XI. Discussion A. Answer to the evaluation question The review shows that severity, exploit likelihood, and organizational context answer different questions [4]–[15]. The synthetic test shows that PECR can reorder the same cases. Case D fell three places because its high severity did not come with strong path, privilege, blast-radius, consequence,

or concentration signals. Cases B and E moved up. Their exploitation, reachability, privilege, and management-plane context added information that CVSS did not include. PECR can support traceable decisions by showing factors, dates, sources, confidence, and score contributions. We can test this through record completeness and repeatable calculations. We should not call PECR easier for people to understand without an analyst study. That study should measure understanding, trust, and decision quality. B. Coverage of the research questions

12

TABLE VII Synthetic Evaluation Results Outcome

Statistic or test

Result

Rank association Rank movement Top-k overlap External validity Traceability Robustness Operational impact

Kendall’s 𝜏𝑏 ; exact test; tie handling 𝜏𝑏 = 0.40; exact two-sided 𝑝 = 0.483; no ties MARS; median and maximum shift MARS = 1.2; median = 1; maximum = 3 Jaccard at the reported k 𝐽3 = 0.50; shared cases: A and B External outcome metric and effect size Not tested; the synthetic corpus has no ground truth Complete records and recomputation 5/5 complete by construction; no independent user study Ablation and bounded weight perturbation Base order retained in 8/10 ablations and 87.5% of 1,024 ±20% weight corners Workload, SLA, loss, or time-to-risk met- Not measured; no production remediation process was observed ric

TABLE VIII PECR Adoption Maturity Model Stage

Capability

Exit criterion

1. Inventory

Map vulnerabilities to assets, SD-WAN roles, owners, and CVSS/EPSS/KEV snapshots. Add normalized external exposure and telemetry freshness with 2. Exposure source timestamps. 3. Path and consequence Add topology, reachability, privilege, blast radius, consequence, and concentration. 4. Cryptographic readi- Add the bounded C-BOM, data lifetime, migration lead time, ness and crypto-agility evidence. 5. Validated operation Calibrate against outcomes; monitor drift, stability, overrides, workload, and decision quality.

At least 95% of in-scope assets have current ownership and vulnerability-asset mapping. Exposure evidence and age are available for the operational queue; unknowns are explicit. Rank records reproduce from a versioned graph and approved business-impact inputs. Critical trust chains have owners, algorithm inventory, and tested transition plans. The model meets preregistered outcome and robustness thresholds across more than one implementation.

TABLE IX Answers and Evidence Boundaries for the Research Questions Question

Bounded evidence and synthetic result

Conclusion and residual boundary

PRQ / RQ1

The corpus supports distinct constructs for severity, exploitation, exposure, consequence, topology, and cryptographic readiness [4]–[27]. Severity, predicted exploitation, and observed exploitation are distinct signals [4], [5], [12], [13], [15]. Consequence and co-exploitation have adjacent support [18], [19]; contextual ordering is supported [6]–[10]. Software-defined, hybrid-cloud, IoT, and automotive studies provide transferable architecture concepts [6]–[8], [16], [22]. FIPS 203–205 define current PQC standards; NIST guidance supports transition inventory and crypto agility [23]–[27]. Prior work supports contextual weights, sensitivity analysis, and explicit evidence provenance [6], [8]–[10], [14]. The order changed from A–D–B–E–C to A–B–E–C–D. The results were 𝜏𝑏 = 0.40, MARS = 1.2, and 𝐽3 = 0.50.

Retain ten factors as a staged research specification. Evidence strength is unequal, and the set is not claimed to be optimal. High confidence for separating these signals; moderate for exposure; limited direct evidence for telemetry-freshness rules. Direct SD-WAN reachability, privilege, blast-radius, and concentration measurements remain unvalidated. Controller centrality, direct Internet access, and segmentation are plausible modifiers, but the corpus contains no direct SD-WAN validation. Standards justify a bounded C-BOM and migration-readiness construct, not a validated daily triage weight. Use a transparent additive score with a separate confidence measure; equal weights remain an illustrative baseline. PECR can produce a measurably different and decomposable ranking. Better operational outcomes and human explainability were not tested.

RQ2 RQ3 RQ4 RQ5 RQ6 ERQ

C. Evidence boundary and unresolved gaps

Cryptographic readiness may raise a long-term confidentiality This review reports published results and does not indepen- risk. However, it may push down an urgent and exploitable flaw dently repeat the original experiments. Claims from abstracts when both use one queue. A two-lane queue or an escalation are limited to the information in those abstracts. Reviews are rule may work better than one unrestricted score. Direct use in kept separate from primary studies to avoid double counting. SD-WAN is still uncertain. This study did not test live topology, The DOI-based study set is not exhaustive. One reviewer vendor adapters, analyst understanding, or remediation results. completed the quality check, and the equal-weight test is SSVC decision trees, two-stage gates, and learning-to-rank synthetic. PRISMA is a reporting guide [1], but this project models are reasonable alternatives. PECR should be used does not have the retrieval and screening counts needed for operationally only after testing these alternatives on the same a PRISMA claim. We therefore call it a bounded multivocal data. review based on software-engineering guidance [2], [3]. XII. Methodological Risks and Validity Threats D. Interpretation and practical trade-offs Corpus coverage: The DOI-led, bounded evidence set may More factors do not automatically make PECR better. Its omit relevant databases, non-English work, unpublished negamain value is that readers can see why a case changed position. tive results, and product-independent SD-WAN studies. This visibility also shows the trade-offs. Large exploitation Evidence asymmetry: PQC readiness depends mainly on or exposure weights may overreact to noisy data. Small standards and transition guidance, while its daily vulnerabilityweights may miss an exploited flaw with moderate severity. prioritization value remains empirically untested.

13

Reviewer bias: One reviewer selected, extracted, and appraised Code Availability Statement: The calculations are fully the bounded corpus. No kappa statistic or adjudication process specified by Equations (1)–(4), Tables V–VII, and the stated is available. perturbation procedure. Construct validity: Decision traceability, analyst compre- Ethics Approval: Not applicable. The work used published hension, remediation utility, and risk reduction are distinct literature and synthetic data only. Any future operational study outcomes and must not be collapsed. requires separate institutional review. Temporal validity: Standards, catalogs, and predictive models AI-Use Disclosure: The author utilized AI-assisted editing can change. Their version and status must be rechecked at tools for language polishing, LaTeX formatting, document submission and in every operational run. structuring, and calculation auditing. The author independently Synthetic-data validity: Five designed cases can demonstrate verified all outputs and maintains full responsibility for the mechanics and failure modes but cannot estimate population contents of the manuscript. effects, calibration, workload, or field performance. Unit-of-analysis mismatch: Vendor, vulnerability, asset, and References attack-path rankings are not directly comparable without an explicit mapping. [1] M. J. Page et al., “The PRISMA 2020 statement: an updated guideline Source-depth limitation: An abstract can support only abstractfor reporting systematic reviews,” BMJ, vol. 372, p. n71, 2021. https: //doi.org/10.1136/bmj.n71 level claims; it cannot establish unreported baselines, sampling [2] B. Kitchenham and S. Charters, Guidelines for Performing Systematic decisions, statistical tests, or operational effectiveness. Literature Reviews in Software Engineering, Version 2.3, EBSE-2007-01, Weight and model drift: Equal weights are not calibrated. Keele University and Durham University, 2007. EBSE systematic-review Operational evaluations must freeze factor definitions, EPSS guidelines [3] V. Garousi, M. Felderer, and M. V. Mäntylä, “Guidelines for including version, transformations, weights, and retrieval dates. grey literature and conducting multivocal literature reviews in software Implementation validity: Vendor neutrality is specified at the engineering,” Information and Software Technology, vol. 106, pp. 101– schema boundary but was not tested with two independent 121, 2019. https://doi.org/10.1016/j.infsof.2018.09.006 [4] E. H. Tan, I. E. Unal, S. Rhea, and U. Tatar, “Analysis of vulnerability SD-WAN implementations. XIII. Conclusion The review supports a vendor-neutral PECR research model. It keeps severity, exploitation, exposure, topology, privilege, blast radius, consequence, concentration, and cryptographic readiness as separate factors. Evidence is strongest for separating severity from exploitation and adding organizational context. Evidence is weaker for live SD-WAN attack paths and a daily PQC migration weight. A clear additive score with a separate confidence value is a reasonable starting point. However, its weights are policy choices, not universal constants. In the five-case test, CVSS and PECR produced different orders. The results were 𝜏𝑏 = 0.40, exact 𝑝 = 0.483, MARS = 1.2, and 𝐽3 = 0.50. The PECR order stayed the same in 87.5% of the tested weight combinations. This answers the narrow question: PECR can produce a different and traceable ranking. It does not show that the ranking is more accurate, safer, easier to understand, or better in practice. The main contribution is a clear model, a worked calculation, and a path for future testing with real SD-WAN data. Declarations Funding Statement: This research received no external funding. Conflict of Interest Statement: The author declares no conflicts of interest. CRediT Author Statement: Saeed Alam: Conceptualization, methodology, investigation, formal analysis, writing—original draft, writing—review and editing, and project administration. Data Availability Statement: All literature records are publicly identified in the reference list. The complete synthetic evaluation matrix and ranks are reported in Tables V and VI. No production network or personal data were used.

severity and exploit probability scoring frameworks: CVSS and EPSS,” in Proc. 2025 IEEE Systems and Information Engineering Design Symposium (SIEDS), pp. 54–59, 2025. https://doi.org/10.1109/SIEDS65500. 2025.11021216 [5] N. Shimizu and M. Hashimoto, “Vulnerability management chaining: An integrated framework for efficient cybersecurity risk prioritization,” IEEE Access, vol. 14, pp. 31407–31424, 2026. https://doi.org/10.1109/ ACCESS.2026.3665768 [6] V. Ahmadi Mehri, P. Arlos, and E. Casalicchio, “Automated contextaware vulnerability risk management for patch prioritization,” Electronics, vol. 11, no. 21, Art. no. 3580, 2022. https://doi.org/10.3390/ electronics11213580 [7] S. P. Dubey and S. Maity, “Context-aware enterprise vulnerability prioritization and remediation recommendations using semantic learning,” in Proc. 5th Int. Conf. Sentiment Analysis and Deep Learning (ICSADL), pp. 1137–1142, 2026. https://doi.org/10.1109/ICSADL67539.2026.11451870 [8] K. G. Agyei et al., “Explainable risk-based vulnerability prioritization in hybrid cloud: Integrating CVSS, EPSS, and CISA KEV with asset criticality signals,” World Journal of Advanced Research and Reviews, vol. 30, no. 1, pp. 2044–2052, 2026. https://doi.org/10.30574/wjarr.2026. 30.1.1006 [9] Shreyas A and Arun Kumar B. R., “Adaptive vulnerability prioritization with MITRE ATT&CK integration,” in Proc. 2025 IEEE 17th Int. Conf. Computational Intelligence and Communication Networks (CICN), pp. 733–739, 2025. https://doi.org/10.1109/CICN67655.2025.11368172 [10] A. Anwer and L. Ali, “A machine learning-driven visual analytics framework for cybersecurity risk prioritization using the CISA KEV catalog,” European Modern Studies Journal, vol. 10, no. 2, pp. 705–726, 2026. https://doi.org/10.59573/emsj.10(2).2026.40 [11] S. R. Sri, “CVSS + EPSS combined vulnerability prioritisation in SMEfocused ITAM SaaS platforms: A practitioner’s framework,” SSRN Electronic Journal, preprint, 2026. https://doi.org/10.2139/ssrn.6462364 [12] J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit Prediction Scoring System (EPSS),” Digital Threats: Research and Practice, vol. 2, no. 3, pp. 1–17, 2021. https://doi.org/10.1145/ 3436242 [13] V. Koscinski, M. Nelson, A. Okutan, R. Falso, and M. Mirakhorli, “Conflicting scores, confusing signals: An empirical study of vulnerability scoring systems,” in Proc. 32nd ACM Conf. Computer and Communications Security (CCS), pp. 1904–1918, 2025. https://doi.org/10.1145/ 3719027.3765210 [14] L. Allodi, M. Cremonini, F. Massacci, and W. Shim, “Measuring the accuracy of software vulnerability assessments: Experiments with students and professionals,” Empirical Software Engineering, vol. 25, no. 2, pp. 1063–1094, 2020. https://doi.org/10.1007/s10664-019-09797-4

14

[15] E. Iannone, G. Sellitto, E. Iaccarino, F. Ferrucci, A. De Lucia, and F. Palomba, “Early and realistic exploitability prediction of just-disclosed software vulnerabilities: How reliable can it be?” ACM Transactions on Software Engineering and Methodology, vol. 33, no. 6, pp. 1–41, 2024. https://doi.org/10.1145/3654443 [16] O. Briliyant, Girinoto, M. Syahral, and R. Purwoko, “Enhancing IoT vulnerability prioritization using real-time EPSS and SSVC decision tree modeling,” in Proc. 2025 IEEE 2nd Int. Conf. Cryptography, Informatics, and Cybersecurity (ICoCICs), pp. 185–191, 2025. https://doi.org/10. 1109/ICoCICs68032.2025.11383863 [17] K. Chhillar, S. Shrivastava, R. K. Saini, and A. Verma, “A hybrid AI model for automated vulnerability prioritization based on risk scoring,” in Proc. 2025 Int. Conf. Digital Innovations for Sustainable Solutions (ICDISS), pp. 1–6, 2025. https://doi.org/10.1109/ICDISS68238.2025. 11320782 [18] B. Moraghebi and L. Ali, “Ransomware-aware analysis of exploited vulnerabilities and remediation dynamics,” European Modern Studies Journal, vol. 10, no. 2, pp. 727–45, 2026. https://doi.org/10.59573/emsj. 10(2).2026.41 [19] Y. Yu, K. Luo, X. Hu, and Y. Zhang, “Knowledge-driven prediction of vulnerability co-exploitation,” in Proc. 2025 IEEE 6th Int. Seminar Artificial Intelligence, Networking and Information Technology (AINIT), pp. 1987–1993, 2025. https://doi.org/10.1109/AINIT65432.2025.11035711 [20] G. Siewruk and M. Berej, “Transformation of vulnerability management through artificial intelligence: An overview of generative and learning models,” IEEE Access, vol. 14, pp. 24732–24752, 2026. https://doi.org/ 10.1109/ACCESS.2026.3663784 [21] Y. M. Lysetskyi, “Vulnerability management as an organizational and technical process,” Mathematical Machines and Systems, no. 2, pp. 38–45, 2026. https://doi.org/10.34121/1028-9763-2026-2-38-45 [22] D. K. Oka and R. S. Vadamalu, “Considerations for vulnerability management in the automotive industry,” SAE Technical Paper 2026-260626, 2026. https://doi.org/10.4271/2026-26-0626 [23] National Institute of Standards and Technology, Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 203, Aug. 2024. https: //doi.org/10.6028/NIST.FIPS.203 [24] National Institute of Standards and Technology, Module-Lattice-Based Digital Signature Standard, FIPS 204, Aug. 2024. https://doi.org/10.6028/ NIST.FIPS.204 [25] National Institute of Standards and Technology, Stateless Hash-Based Digital Signature Standard, FIPS 205, Aug. 2024. https://doi.org/10.6028/ NIST.FIPS.205 [26] D. Moody, R. Perlner, A. Regenscheid, A. Robinson, and D. Cooper, Transition to Post-Quantum Cryptography Standards, NIST IR 8547 Initial Public Draft, Nov. 2024. https://doi.org/10.6028/NIST.IR.8547.ipd [27] E. Barker et al., Considerations for Achieving Crypto Agility: Strategies and Practices, NIST CSWP 39upd1, updated June 2026. https://doi.org/ 10.6028/NIST.CSWP.39-upd1

Related documents

• 22 U.S.C. § 262p-4i — Multilateral development banks and debt-for-nature exchanges#580145
• NEET Rates for International Territorial Level 3 Areas, 2022-2024#632041
• Awareness, adoption readiness and barriers to the uptake of downstream space technologies among European SMEs: Findings from a cross-sectoral survey.#796724
• Modeling Sparse and Bursty Vulnerability Sightings: Forecasting Under Data Constraints#31198
• ESA Climate Change Initiative Plus - Soil Moisture - Product Validation and Intercomparison Report (PVIR) - Supporting Product Version v09.2#11871