Overview
This article explains how finding prioritization works in Hyver.
Hyver uses a dynamic algorithm that weighs multiple factors — including severity, likelihood, and business asset exposure — to help you focus on the vulnerabilities that matter most.
What influences prioritization?
Hyver’s prioritization engine considers a combination of technical and business factors, including:
Severity of the finding
Whether it is Critical to Block
Probability (likelihood of successful exploitation)
Importance of the affected business asset
Position of the finding on the attack route
Whether the finding appears on multiple routes in the mitigation graph
Organizational prioritization objectives
Hyver lets you define what matters most to your organization. Prioritization logic can be aligned to one of the following strategic objectives:
Business Asset Exposure — focus on the assets with the highest risk
Likelihood of attack — prioritize by probability of exploitation
Asset importance — factor in operational impact and asset criticality
How exposure influences prioritization
Findings are ranked primarily based on the exposure of the business assets they affect.
All business assets must have an exposure value assigned for accurate prioritization.
See: [How the Exposure Calculation Works] for full details on exposure logic.
Exposure v1
Only findings that lie on active, exploitable routes to business assets receive an exposure score.
Exposure v2
All findings are assigned an exposure value — whether or not they’re currently part of an active path.
Example: Prioritization shift after mitigation
In a sample scenario:
F2 has the second highest exposure score
But is ranked third due to its position on the attack path
Once F1 is fixed, F3 may become the top priority — based on updated route logic:
Findings on multiple attack routes
If a finding appears on more than one attack path, it is marked as Critical to Block, raising its mitigation priority.
Wrap-up / Next Steps
Hyver’s prioritization model goes beyond severity — it’s about smart, risk-based decision-making. By aligning mitigation actions with your company’s security goals, you get the highest return on your efforts.