Surface hidden risk: CVEs that clear every attacker gate on a crown-jewel asset are the exposures you must fix first.
Gates (each ≥ threshold to pass):
Crown-jewel criteria: the affected product is tagged as identity, payments, customer data, or production platform. A CVE that clears all four gates on a crown-jewel product is an executive-visible exposure — track to zero.