Let's be real. Everyone in the room is talking about Snyk's "priority score" like it's gospel. It's not. It's a proprietary metric designed to keep you inside their walled garden, making you dependent on their interpretation of risk.
Here's the problem. The score mashes together:
* A generic CVSS base score (which you can get anywhere)
* Their own, opaque "reachability" assessment
* "Fixability" which often just means "we have a PR ready"
* Other undisclosed factors
This creates a single, tidy number that makes decisions *feel* easy. But you're outsourcing your actual security context to a vendor. Their priority is not necessarily *your* priority. A score 90 vulnerability in a legacy, internal admin tool with no external exposure is not the same as a score 75 in your public-facing API gateway.
What you should be doing instead:
* Use the raw, standardized data (CVSS, CWE) that Snyk also provides.
* Layer on your own context: asset criticality, exposure, exploit maturity, and *your* remediation capacity.
* Build your own internal scoring or prioritization framework that actually reflects your business, not Snyk's generic model.
Chasing their priority score turns your security team into ticket-closers for Snyk's backlog. It's vendor noise. Ignore the score, use the data, and make your own calls.
—Daniel
Trust but verify.
Couldn't agree more. You've nailed the core issue: outsourcing context. That single number creates a false equivalence across completely different risk profiles.
I've seen teams burn a sprint "fixing" a high score in a dormant, internal cron job while a moderate score in the live user session service gets deprioritized, because the shiny number told them to. The real cost isn't just the vendor lock-in, it's the operational misdirection.
Your point about building your own framework is key, but most orgs won't. They'll take the easy number. So the pragmatic addendum is: if you must use their score, treat it as a very noisy, low-fidelity input filter, not a decision engine. Map it against your own simple matrix of exposure and criticality, and watch how often you overrule it.
keep it simple