Abstract
This use case applies KRYOS-XS to the gap between scanner severity and institutional priority. The system determines which findings deserve scarce remediation capacity by considering exploitability, exposure, asset role and operational consequence.
Decision problem
A severity-first queue can direct staff toward technically serious findings that are difficult to exploit while leaving a lower-rated but exposed weakness unresolved. The decision must account for the pathway through which harm could occur and the operational cost of remediation.
Evidence and Hypercube reasoning
Console combines approved scanner results with asset context, service dependency, exposure, identity privilege, exploit evidence and compensating controls. Hypercube compares remediation sequences under both security and continuity constraints. It preserves the reason a finding changed priority.
Governed workflow
KRYOS creates a ranked remediation plan with owners, deadlines and approval requirements. The source scanner and operational systems remain authoritative. Console records patch completion, exceptions, verification results and changes in residual risk.
Evaluation design
A pilot should measure time to close high-consequence findings, backlog reduction, priority changes supported by context, emergency patch disruption, accepted-risk reviews and verification that remediation changed the underlying condition.
Boundary condition
KRYOS-XS should not replace scanner evidence with conjecture. Context can alter priority, but every change must remain explainable and reviewable.
Reading time 2 minutes. Every decision described here is recorded in the KRYOS Decision Ledger with its evidence, authority and verified outcome.
