Severity describes the technical impact of a finding. Priority adds fleet exposure, device importance, and whether a fix is available so teams can decide what to address first.
Severity levels
- Critical, base 4000: likely credential compromise, malicious package behavior, or a vulnerability with material access impact.
- High, base 3000: exploitable vulnerable software, exposed sensitive assets, or supply-chain behavior that needs prompt action.
- Medium, base 2000: risky dependency state, install lifecycle scripts, or sensitive metadata that requires review.
- Low, base 1000: weak signals and hygiene issues that add investigation context but rarely require interruption.
- Informational, base 0: inventory and explanatory records without a confirmed vulnerability.
Grouping
Runtrace groups open findings by advisory identifier, package ecosystem, and package name. One group shows the total number of affected devices and findings, while preserving the installed version and evidence for each device.
Priority score
- Severity: critical 4000, high 3000, medium 2000, low 1000, informational 0.
- CVSS: score multiplied by 100 when the advisory provides a score.
- Fleet exposure: 25 points per affected device, capped at 100 devices.
- Highest affected-device criticality: critical 500, high 300, standard 100, low 0.
- Confirmed malicious-package signal: 1000.
- Listed in CISA's Known Exploited Vulnerabilities catalog: 1500.
- FIRST EPSS probability: score multiplied by 1000.
- Fixed version or concrete remediation available: 200.
Priority bands
- P0, 5000 or higher: immediate review and an assigned remediation owner.
- P1, 4000 to 4999: prompt remediation with progress tracked to closure.
- P2, 3000 to 3999: planned remediation based on exposure and affected critical devices.
- P3, below 3000: backlog or monitor unless local business context raises the priority.
Workflow
Default summaries count open, non-allowlisted findings. Fixed, accepted-risk, false-positive, and allowlisted records remain available in history and exports. Changing device criticality immediately changes the business-context component of grouped vulnerability priority.