Surface hidden risk: if ignored, how far could each CVE damage the business — measured against critical process footprints.
Blast radius = 50% CIA impact + 30% exploitability + 20% attack vector reach.