Organizations struggle to handle sheer number of vulnerabilities in their cloud environments. The de facto methodology used for prioritizing vulnerabilities is to use Common Vulnerability Scoring System (CVSS). However, CVSS has inherent limitations that makes it not ideal for prioritization. In this work, we propose a new way of prioritizing vulnerabilities. Our approach is inspired by how offensive security practitioners perform penetration testing. We evaluate our approach with a real world case study for a large client, and the accuracy of machine learning to automate the process end to end.

翻译：各组织在云层环境中努力处理为数众多的弱点。事实上,确定脆弱性优先次序的方法是使用共同脆弱度测算系统(CVSS)。然而,CVSS的内在局限性使得确定优先次序不理想。在这项工作中,我们提出了新的确定脆弱性优先次序的方法。我们的方法受到攻击性安全从业者如何进行渗透测试的启发。我们用一个针对大客户的实实在在的世界案例研究来评价我们的方法,以及机器学习如何使进程最终结束自动化的准确性。