Flashpoint Introduces Ransomware Risk Model to Prioritize Vulnerabilities

WASHINGTON, Oct. 1, 2026 /CourierPR/ -- Flashpoint, a global leader in threat intelligence, has developed a new methodology to help security teams prioritize vulnerabilities that are most likely to be targeted by ransomware groups. The company has been awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model, which evaluates newly disclosed vulnerabilities based on more than 60 technical factors to determine the likelihood of their exploitation by ransomware actors.

The Ransomware Risk model, which has been available in Flashpoint Vulnerability Intelligence (VI) since 2022, addresses a critical gap in traditional vulnerability scoring frameworks. While these frameworks, such as Common Vulnerability Scoring System (CVSS), measure the severity of a vulnerability, they do not assess the likelihood of its exploitation by ransomware groups. This gap is particularly significant given the increasing prevalence of Ransomware-as-a-Service (RaaS) attacks. According to Flashpoint, there was a 45% increase in RaaS attacks in the first half of 2026.

The Ransomware Risk model works through a four-step process: 1. Multi-factor fingerprinting: Each vulnerability is profiled against more than 60 technical factors, such as whether it can be exploited remotely without authentication, whether it affects operational technology (OT) systems, and how it could affect data availability. 2. Coordinate mapping: The model turns each multi-factor fingerprint into a set of values that place the vulnerability on a map, allowing vulnerabilities with similar profiles to cluster together. 3. Cluster check: Historical threat data identifies clusters where vulnerabilities exploited in real-world ransomware attacks group together. 4. Likelihood rating: Each new vulnerability is rated as Low, Medium, High, or Critical based on how close it lands to those clusters.

This model updates as new ransomware activity is confirmed, ensuring that ratings reflect current attack patterns. It covers every vulnerability tracked by Flashpoint VI, including more than 105,000 that are not in the Common Vulnerabilities and Exposures (CVE) or National Vulnerability Database (NVD).

In Flashpoint Ignite, the Ransomware Risk score appears alongside other metrics such as CVSS (v3 and v4), Exploitability Score (EPSS), Social Risk, and exploit maturity. This allows security teams to flag lower-severity vulnerabilities that CVSS alone might deprioritize but that closely match ransomware targets.

The Ransomware Risk model was developed by Flashpoint's Ben Haynes and Jacob Kouns.

By providing an earlier signal to security teams, the Ransomware Risk model helps organizations prioritize patching efforts more effectively, reducing the risk of ransomware attacks. The model is now available to Flashpoint's customers, enhancing their ability to protect against the evolving threat landscape.