The 12-Layer
Vulnerability Intelligence Engine

Executive Summary

TRIS v1 combined seven signals into a single vulnerability risk score: CVSS, EPSS, CISA KEV, threat actor targeting, asset criticality, exposure, and BASzy exploit validation. It shipped 30 days ago. It worked. It beat CVSS-only prioritization by a wide margin from the first week. But after 30 days of production feedback across healthcare, finance, federal systems integrators, and critical infrastructure, the same five gaps kept surfacing independently from five different practitioner cohorts. We did not wait for a Q4 release cycle to close them. TRIS v2 shipped 30 days after v1.

Seven layers told you whether a vulnerability was dangerous in theory and active in the wild. They didn't tell you whether your controls could actually stop it. They didn't tell you how deep it sat in your software supply chain. They didn't tell you whether it was accelerating or decaying on the exploitation curve. And they didn't translate technical severity into the one language every board understands: money.

TRIS v2 adds five new intelligence layers that no other vulnerability scoring system combines: attack-path blast radius, supply-chain dependency propagation, defense efficacy coefficient, predictive threat trajectory, and FAIR-based financial impact quantification.

The result is a 0-100 score that correlates with actual breach probability and actual business impact for your specific organization. It runs entirely on your hardware. Your data never leaves your network.

Why Seven Layers Weren't Enough

Every scoring system in the market today answers a subset of the questions security teams actually need answered. CVSS, EPSS, SSVC, Tenable VPR, Qualys TruRisk, Picus PXS, TRIS v1, every one of them misses something critical. That's not an exaggeration. It's the conclusion of a twelve-month audit of the vulnerability scoring landscape.

The Gap Analysis

Here's what every existing system misses:

• No attack path modeling. A critical vulnerability on an isolated dev server is not the same as a critical vulnerability one hop from your domain controller. Every major scoring system treats them identically.
• No supply chain awareness. When Log4Shell broke, organizations spent weeks figuring out which applications depended on the vulnerable library, transitively. No scoring system quantifies transitive SBOM-aware risk.
• No defense efficacy. A CVE that maps to three ATT&CK techniques is much easier to contain if your EDR already detects those techniques. No scoring system cross-references vulnerabilities against the techniques your controls actually cover.
• No predictive trajectory. EPSS predicts exploitation probability, but it's trained on historical data. It struggles to identify vulnerabilities accelerating from proof-of-concept to weaponized in real time.
• No financial quantification. Security teams report in technical severity. Boards report in dollars. No scoring system bridges that gap.

TRIS v2 closes every one of these gaps.

The 12-Layer Architecture

TRIS v2 organizes its scoring into three tiers: foundational signals (Layers 1-3), contextual signals (Layers 4-7), and the five novel dimensions (Layers 8-12) that separate TRIS v2 from every competitor.

Priority Bands

TRIS v2 outputs a 0-100 score and a priority band. The bands map directly to SLA obligations and team workflows:

Score separation is meaningful. Because TRIS v2 uses a diminishing returns function across its twelve layers, a vulnerability scoring 94 is materially different from one scoring 76. Compare this to CVSS, where 57% of all CVEs score 7.0 or higher and only 2.3% are ever actually exploited, a compression problem TRIS v2 was designed to eliminate.

How TRIS v2 Compares

TRIS v2 is the only scoring system with a checkmark in every row.

A Tale of Two CVEs

To see what TRIS v2 changes in practice, consider how it handles two vulnerabilities that CVSS and TRIS v1 would score similarly.

Local-First by Design

TRIS v2 operates entirely on your hardware. There is no SaaS telemetry bus, no cloud scoring service, no vendor-side database storing your asset inventory. Every layer computes locally against the data CVEasy AI already has in its SQLite database.

This is a deliberate architectural choice. Three of TRIS v2's twelve layers. L5 Asset Criticality, L8 Attack Path Blast Radius, and L9 Supply Chain Propagation, require deep knowledge of your internal network topology, your asset inventory, and your SBOM. Sending that information to a cloud scoring service isn't just a compliance problem for air-gapped environments and regulated industries. It's a competitive intelligence leak. TRIS v2 refuses to make that tradeoff.

Your data never leaves your network. Your scoring never depends on someone else's cloud being up. Your patent-pending intelligence engine runs on the same hardware that hosts your CVE database. That's not a marketing position. It's the architecture.

Implementation

TRIS v2 is built into CVEasy AI and runs automatically. There is no configuration required. As soon as vulnerability data is imported (from Nessus, Qualys, Rapid7, OpenVAS, Nuclei, Burp, ZAP, Trivy, or CSV), TRIS v2 scores are calculated for every CVE on every asset.

Scores update dynamically when:

• EPSS scores refresh from FIRST.org
• New CVEs are added to the CISA KEV catalog
• Threat actor intelligence feeds update
• BASzy runs new attack simulations
• Asset topology changes (new segmentation, new firewall rules)
• SBOM data updates (new dependency versions)
• EDR/BAS control validations run
• Exploit velocity signals change
• Remediation is applied and verified

Patent Claims (Summary)

TRIS v2 is protected by patent claims covering its novel scoring dimensions and their composition. The five novel layers, attack path blast radius, supply chain dependency propagation, defense efficacy coefficient, predictive threat trajectory, and financial impact quantification, are protected both individually and as a composite scoring system.

Specific formulas, multipliers, diminishing-returns parameters, and threshold values are proprietary and not disclosed in this paper. CVEasy AI customers receive access to the full specification under mutual NDA as part of enterprise deployments.

Conclusion

CVSS answers: how severe is this?

EPSS answers: how likely is this to be exploited?

KEV answers: is this being exploited right now?

TRIS v2 answers: how urgently do I need to fix this, on this asset, in my environment, given my defenses, given my dependencies, given where the threat is heading, and given what it will cost if I'm wrong?

Twelve independent intelligence layers. Five of them brand new. Zero cloud dependency. One actionable score.

Your scoring engine should answer to practitioners, not to someone else's cloud.