Risk-Based Vulnerability Prioritization
By Richard Augenti
Reduce thousands of raw scanner findings to the handful that matter, using exploitability, reachability and real exposure rather than CVSS score alone.
Free to browse. Takes about 45 minutes once you start.
Lab Overview
A scan of the payments platform came back with roughly 400 findings, dozens of them CRITICAL. You cannot fix 400 things this sprint, and "fix all criticals" is how teams end up patching a theoretical bug while a known-exploited one sits untouched.
In this lab you enrich the raw findings with exploit-likelihood (EPSS) and known-exploited (CISA KEV) data, drop the ones a VEX document says do not affect you, and produce a ranked top ten you could defend to an auditor. The output is a decision with reasons attached, not a severity sort.
This lab is Python and JSON - no containers and no network. All the enrichment data is bundled and frozen on the machine, so your ranking is reproducible rather than dependent on the day you ran it.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH. Python and the finding data are already in place - no containers are used. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Offline and frozen: EPSS, KEV and VEX data are bundled on the machine at a fixed point in time, so results are reproducible and nothing is fetched from the internet.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.