🤖 AI Summary
Traditional static scoring systems, such as CVSS, fail to capture real-time exploitability, network exposure, attack paths, business impact, and cryptographic migration risks, limiting their effectiveness in guiding vulnerability remediation priorities within SD-WAN environments. To address this gap, this work proposes PECR—a vendor-neutral framework that uniquely integrates predictive exposure, cryptographic readiness, and organizational context. By normalizing multi-source evidence, applying weighted scoring, and incorporating confidence assessment, PECR enables traceable and auditable vulnerability prioritization. Empirical evaluation demonstrates that PECR consistently produces stable rankings distinct from CVSS (e.g., A-B-E-C-D) across five synthetic scenarios, with 87.5% of weight configurations yielding identical orderings. Furthermore, the framework exhibits robustness under factor ablation and bounded perturbation tests.
📝 Abstract
SD-WAN teams often use static severity scores to decide what to fix first. These scores do not show live exploitation, network exposure, attack paths, business impact, or cryptographic migration risk. This study asks whether a vendor-neutral PECR framework can produce a different and more traceable ranking than CVSS alone. We reviewed 19 DOI-verified publications from 2020-2026 and five current NIST documents. The review supported ten normalized factors, one weighted score, and a separate confidence measure. We then compared equal-weight PECR with CVSS in five synthetic cases. The tests used Kendall's $τ_b$, mean absolute rank shift (MARS), top-three Jaccard overlap ($J_3$), factor removal, and bounded weight changes. CVSS ranked the cases A-D-B-E-C. PECR ranked them A-B-E-C-D. The results were $τ_b = 0.40$, MARS = 1.2, and $J_3 = 0.50$. The exact $τ$ test was not significant ($p = 0.483$) because the sample had only five cases. The PECR order remained unchanged in 87.5% of 1,024 weight combinations. It also remained unchanged in eight of ten single-factor removal tests. The evidence supports separate measures for severity, exploitation, and organizational context. Evidence for live SD-WAN attack paths and daily PQC triage is still limited. PECR can produce a different and auditable ranking. This synthetic test does not prove better operational results or better human understanding.