Search papers, labs, and topics across Lattice.
This paper introduces the Predictive Exposure and Cryptographic Readiness (PECR) method for prioritizing vulnerabilities in software-defined wide-area networks (SD-WAN) by integrating multiple factors such as severity, threat, reachability, and consequence. The evaluation of PECR against traditional prioritization methods shows significantly higher Kendall 蟿 values, indicating a more effective ranking of vulnerabilities based on current exposure and evidence quality. The study emphasizes the importance of a reproducible specification and synthetic stress testing in vulnerability management, although it does not assess predictive accuracy or production effectiveness due to the absence of real outcome labels.
PECR outperforms traditional vulnerability prioritization methods, achieving a Kendall 蟿 value of 0.924, highlighting the critical role of contextual factors in effective risk management.
Software-defined wide-area networking concentrates operational authority in controllers, orchestrators, and Internet-facing edges, but severity-only remediation queues do not represent current exposure or evidence quality. This paper specifies Predictive Exposure and Cryptographic Readiness (PECR), a decision-support method that combines nine normalized severity, threat, reachability, and consequence factors while reporting confidence and score intervals separately. Cryptographic dependencies enter an independent migration queue. The evaluation uses 100 role- and zone-conditioned synthetic vulnerability-asset records over 62 role-consistent assets, plus 30 independent generator replications. Against the operational PECR order, CVSS-only, EPSS-only, KEV-first, and CVSS x EPSS queues yield Kendall $\tau$ values of 0.196, 0.221, 0.301, and 0.234; a stronger five-factor context-lite comparator yields 0.755. Across 30,000 joint Dirichlet weight draws, median $\tau$ is 0.836, 0.893, and 0.924 under broad, moderate, and narrow perturbations. Masking 10% of factor cells labels 47 records as evidence-limited because their intervals cross a decision boundary. The study establishes executable specification, synthetic queue differentiation, and stress-test robustness. It does not establish predictive accuracy, avoided loss, or production effectiveness because no real outcome labels are used.
