- Decompose a vulnerability into distinct terminal consequences.
- Expose source, inference, and assumption boundaries.
- Represent authority, perception, safety, privacy, systemic, and recovery paths.
- Retain published scores as comparison baselines.
Purpose and design
Measure the reachable consequence, not the drama around the flaw.
CFSE Consequence Paths is a public candidate model for asking what changes after exploitation: which boundary is crossed, what capability is gained, which terminal consequence becomes reachable, how far it scales, and what recovery requires.
A score is the output.
The path is the argument.
Each public record separates source-backed facts from model inferences and operational assumptions. That separation makes a reviewer’s disagreement precise: challenge a step, a field, the dominance decision, or the evidence—not an unexplained number.
Not metric fields
Nine model design requirements.
These are failure modes the model must resist. They explain why the model exists; the actual vector fields and scoring rules are documented separately.
- 01
Blast radius is a property of the path
Distinguish one-device execution from a credential, artifact, or control-plane primitive that can be reused across a deployment.
- 02
Chains stay composed
Keep the remote leak, local payload, boundary crossing, and terminal consequence in one inspectable argument instead of scoring isolated fragments.
- 03
Authority is not merely data
Treat a shipped credential, engineering backdoor, root primitive, or signing bypass as an authority failure, even when the first observation looks like disclosure.
- 04
The flaw is not the device class
A medical or robotic product does not make every weakness catastrophic. Consequence must follow from the reachable capability, not the product label.
- 05
A missing control is not an exploit
Insufficient logging or monitoring can worsen detection and recovery, but it cannot invent reachability, execution, authority, or physical effect.
- 06
Unknown does not mean worst
Represent uncertainty in evidence and review state. Do not resolve every unknown upward and create an artificial ceiling pile-up.
- 07
Narrative does not change mechanics
Score the documented behavior and deployment path, not vendor origin, dramatic framing, or disclosure rhetoric.
- 08
Recovery changes the consequence
A hotfixable service, per-device reflash, fleet reprovision, trust-root rotation, and physical recall impose materially different burdens.
- 09
Representations can leak sensitive state
A sanctioned output can preserve enough structure to infer a protected input. Sensor privacy includes informative avatars, renderings, predictions, and actuated outputs.
Use boundaries
What this model does—and does not—decide.
- Predict exploitation likelihood.
- Replace deployment-specific asset and safety analysis.
- Set remediation priority by itself.
- Claim empirical accuracy or inter-rater reliability yet.