Flashpoint Patents Model for Prioritizing Vulnerabilities Ransomware Groups May Target
Summary
Flashpoint says its patented model rates vulnerabilities by similarity to flaws used in ransomware attacks, giving security teams another signal for prioritizing remediation alongside severity and exploit-probability scores.
Key points
- Flashpoint was awarded U.S. Patent No. 12,705,360 for the methodology behind its Ransomware Risk model.
- The model compares vulnerabilities against more than 60 technical factors and clusters associated with vulnerabilities used in real-world ransomware attacks.
- New vulnerabilities receive Low, Medium, High, or Critical ratings, which are updated as new ransomware activity is confirmed.
- The model has been available in Flashpoint Vulnerability Intelligence since 2022 and covers vulnerabilities beyond those listed in CVE or the NVD.
- Flashpoint says the score complements CVSS and EPSS by adding ransomware-specific context, including for vulnerabilities with lower severity scores.
- The company reported a 45% increase in RaaS attacks in the first half of 2026.
Article Details
- Event Type
- Flashpoint was awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model methodology.
- Impact
- The model provides ransomware-specific vulnerability risk ratings to help security teams prioritize remediation when vulnerabilities are disclosed. Flashpoint reported a 45% increase in RaaS attacks in the first half of 2026.
People
Vendors
Products
CVSSTraditional vulnerability scoring frameworks, such as CVSS, measure how severe a vulnerability could be, but not whether attackers are likely to use it. That gap is especially costly with ransomware.EPSSIn Flashpoint Ignite, the Ransomware Risk score appears alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity. This lets teams flag lower-severity vulnerabilities that CVSS alone would deprioritize butFlashpoint IgniteIn Flashpoint Ignite, the Ransomware Risk score appears alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity. This lets teams flag lower-severity vulnerabilities that CVSS alone would deprioritize butFlashpoint Vulnerability Intelligence11, 2026, covers the method behind the Ransomware Risk score, which has been available in Flashpoint Vulnerability Intelligence (VI) since 2022. Ransomware RiskFlashpoint announced that it has been awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model. The model rates newly disclosed vulnerabilities by how closely they resemble vulnerabilities known to be used in