How Path Score works

Path Score follows a documented vulnerability mechanism to its terminal consequences, then evaluates exposure, authority, propagation, recovery, and evidence.

Author
Aditya Gupta
Method version
1.0
Published
13 August 2026
Status
Public technical methodology

CVSS and Path Score answer different questions.

CVSS describes vulnerability severity under its metric model. Path Score follows one documented mechanism to a terminal consequence and evaluates the conditions that make that consequence reachable.

They complement each other; a Path Score band is not a conversion of a CVSS score.

Score a path →

01 · Path model

What a path contains

A record contains one vulnerability assessment and one or more paths. Each path contains ordered causal steps: entry or boundary, capability or transition, terminal consequence, and recovery. Every step states whether it comes from a source, a model inference, or an operational assumption.

  1. 01Public record
  2. 02Distinct path
  3. 03Ordered steps
  4. 04Terminal consequence
  5. 05Recovery

The public families are authority, perception, privacy, safety, systemic, and recovery. Terminal types describe the specific consequence within a family.

  • Physical action or therapyDEVICE_CONTROL_SAFETY
  • False perception drives actionPERCEPTION_TO_ACTION
  • Firmware, signing, or trust rootFIRMWARE_TRUST_ROOT
  • Cloud, account, or fleet authorityFLEET_CONTROL_PLANE
  • Account or administrative authorityACCOUNT_AUTHORITY
  • Data or privacy onlyDATA_PRIVACY
  • Sensor or representation privacyPERCEPTION_PRIVACY
  • Availability or recoveryDEVICE_AVAILABILITY
  • Observability or forensic recovery onlyOBSERVABILITY_RECOVERY_ONLY

02 · Published vector fields

What the published vector records

Each published path records thirteen fields describing how it is reached, what it affects, how far it can spread, and the strength and currency of the evidence.

Path conditions

Defines the terminal being assessed and how an attacker reaches it.

TTTerminal type
The specific terminal consequence this path reaches.
REReachability
Attacker position required, from no practical path to default internet exposure.
ECExecution complexity
How reproducible the exploit workflow is, from unsupported to commodity execution.
EXExposure
Derived effective exposure: the lower of RE and EC.

Consequence

Measures the physical, data, and authority effects the path can produce.

PHPhysical / safety
Severity of the safety or bodily consequence, independent of deployment realizability.
DPData / perception
Sensitivity and operational importance of exposed or manipulated data.
ATAuthority
Account, administrative, root, fleet, signing, or trust authority reached.

Propagation

Captures whether the mechanism composes, transfers, or scales.

CHChainability
Whether the path crosses domains or composes into a broader attack.
SRReuse scale
Portability of the artifact, primitive, credential, or design weakness.
SXExecution scale
Whether execution remains per-device or reaches deployment/fleet scale.

Resolution and evidence

Records the recovery cost, supporting evidence, and current status.

ORRecovery burden
From routine local remediation to recall, root rotation, or fleet reprovision.
EVEvidence
From no supporting evidence through public reports and reproduction to field observation.
LSLiveness
Active, partially mitigated, patch available, mitigated, historical, or no current status data.

Derived and contextual values

These values affect caps or promotions but are not additional fields in the published CPATH vector.

EXPDeployment exposure
Exposure of people, processes, or active missions in the deployment context. This is distinct from effective path exposure EX.
CTRLIndependent controls
Strength of controls that independently limit the physical consequence outside the vulnerable mechanism.
GDGuard independence
How independently a safeguard can prevent or bound the physical consequence.
REALDeployment realizability
Derived from PH, EXP, CTRL, and GD. It can cap a physical path when deployment conditions independently bound the consequence.
SYSSystemic reach
Derived from execution scale SX, reuse scale SR, authority AT, and recovery burden OR. It gates at most one systemic promotion.
AActive exploitation
Evidence that exploitation is active. It can promote once and can satisfy the systemic evidence gate.
UExplicit uplift evidence
Separately recorded strong evidence that a systemic uplift is warranted.
FFleet-recovery evidence
Evidence that remediation requires coordinated root rotation, reprovisioning, recall, or fleet recovery.

03 · Aggregation

How the band is calculated

The scoring pipeline selects the strongest matrix result, applies the bounded promotions and caps in their defined order, then evaluates the systemic evidence gate.

01

Effective exposure

The lower of reachability and execution complexity selects the row used by every matrix.

Technical formula
EX=min⁡(RE,EC)EX = \min(RE, EC)
02

Base band

The ordered maximum selects the strongest physical, data or perception, or authority result.

Technical formula
B0=max⁡⪯ ⁣{MPH(EX,PH), MD(EX,DP), MAT(EX,AT)}B_0 = \max_{\preceq}\!\left\{M_{\mathrm{PH}}(EX, PH),\ M_D(EX, DP),\ M_{\mathrm{AT}}(EX, AT)\right\}
03

Promotion and caps

Active exploitation promotes once; path-specific and realizability caps then apply in scoring order.

Technical formula
Bc=CREAL ⁣(Cpath ⁣(PIactive(B0)))B_c = C_{\mathrm{REAL}}\!\left(C_{\mathrm{path}}\!\left(P^{I_{\mathrm{active}}}(B_0)\right)\right)
04

Final band

The systemic promotion occurs only when its exact evidence gate evaluates to one.

Technical formula
Bfinal=PIsys(Bc),Isys=1 ⁣[SYS≥3∧Bc⪰HIGH∧S],S=U∨A∨(F∧OR≥4)∨(PH=4∧REAL=3∧(A∨OR≥4))\begin{aligned} B_{\mathrm{final}} &= P^{I_{\mathrm{sys}}}(B_c),\\ I_{\mathrm{sys}} &= \mathbf{1}\!\left[SYS \ge 3 \land B_c \succeq \mathrm{HIGH} \land S\right],\\ S &= U \lor A \lor (F \land OR \ge 4) \lor \left(PH = 4 \land REAL = 3 \land (A \lor OR \ge 4)\right) \end{aligned}
Notation used in the formulas
MD
The perception-to-action matrix for those paths; the data/privacy matrix otherwise.
P
One-band promotion, saturated at EMERGENCY. Exponent zero leaves the band unchanged.
Cpath, CREAL
The conditional path and deployment-realizability caps defined below.
REAL, SYS
The derived deployment-realizability and systemic-reach values defined above.
Iactive, Isys
Indicator values that apply the active-exploitation or evidence-gated systemic promotion.
A, U, F
Active exploitation, explicit systemic-uplift evidence, and fleet-recovery evidence.

Matrix lookup

Read exposure down, impact across.

  • MONITOR
  • ELEVATED
  • HIGH
  • CRITICAL
  • EMERGENCY
Physical / safety

Maps effective exposure and physical harm to a consequence band.

Scroll horizontally to see all impact levels →

Physical / safety scoring matrix. Exposure increases down the rows and physical impact (ph) increases across the columns.
Exposure (EX) ↓Physical impact (PH) →01234
EX0MONITORMONITORELEVATEDHIGHCRITICAL
EX1MONITORELEVATEDELEVATEDHIGHCRITICAL
EX2MONITORELEVATEDELEVATEDHIGHCRITICAL
EX3ELEVATEDHIGHHIGHCRITICALCRITICAL
EX4ELEVATEDHIGHCRITICALCRITICALEMERGENCY
Authority

Maps effective exposure and acquired authority to a consequence band.

Scroll horizontally to see all impact levels →

Authority scoring matrix. Exposure increases down the rows and authority impact (at) increases across the columns.
Exposure (EX) ↓Authority impact (AT) →01234
EX0MONITORMONITORELEVATEDHIGHCRITICAL
EX1MONITORELEVATEDELEVATEDHIGHHIGH
EX2MONITORELEVATEDELEVATEDHIGHCRITICAL
EX3ELEVATEDHIGHHIGHCRITICALCRITICAL
EX4ELEVATEDHIGHCRITICALCRITICALEMERGENCY
Data / privacy

Maps effective exposure and data or privacy impact to a consequence band.

Scroll horizontally to see all impact levels →

Data / privacy scoring matrix. Exposure increases down the rows and data impact (dp) increases across the columns.
Exposure (EX) ↓Data impact (DP) →01234
EX0MONITORMONITORELEVATEDHIGHHIGH
EX1MONITORELEVATEDELEVATEDHIGHHIGH
EX2MONITORELEVATEDELEVATEDHIGHCRITICAL
EX3ELEVATEDELEVATEDHIGHHIGHCRITICAL
EX4ELEVATEDHIGHHIGHCRITICALCRITICAL
Perception-to-action

Uses the dedicated perception matrix when manipulated data can drive action.

Scroll horizontally to see all impact levels →

Perception-to-action scoring matrix. Exposure increases down the rows and perception impact (dp) increases across the columns.
Exposure (EX) ↓Perception impact (DP) →01234
EX0MONITORMONITORELEVATEDHIGHCRITICAL
EX1MONITORELEVATEDELEVATEDHIGHCRITICAL
EX2MONITORELEVATEDHIGHHIGHCRITICAL
EX3ELEVATEDHIGHHIGHCRITICALCRITICAL
EX4ELEVATEDHIGHCRITICALCRITICALEMERGENCY

04 · Caps and promotions

When a band is capped or raised

  • Observability-only cap. A recovery/observability deficiency with no meaningful physical or authority path is capped at ELEVATED.
  • Low-exposure cap. EX 0–1 is capped at CRITICAL unless fleet execution or active exploitation changes the evidence.
  • Privacy-only cap. A privacy terminal without perception-to-action, material authority, or scale is capped at HIGH.
  • Deployment realizability. An independently bounded physical path may be capped at MONITOR or HIGH.
  • Systemic uplift. SYS 3–4 can add at most one band, and only with active exploitation, fleet-recovery evidence, or another explicit strong condition.

05 · Record verdict

How the record band is chosen

The record band is the highest band reached by any path. One path at that band is dominant; multiple paths at that band are co-dominant. Every lower-band path is supporting.

06 · Evidence labels

What each evidence label means

Source-backed

A claim attributed to a named public source and linked to that source.

Model inference

A transition derived from source facts by applying this method.

Operational assumption

A deployment, scale, guard, or recovery condition required for the path.

EV records the overall strength of the evidence supporting the path.

Technical scorer reference →

07 · Authorship and citation

Cite the method, preserve the evidence boundary.

Methodology authorAditya Gupta

Consequence Paths is a specialized method in the CFSE methodology network.

Suggested citationGupta, Aditya. “CFSE Consequence Paths: A Method for Tracing Vulnerabilities to Cyber-Physical Consequences.” CFSE Paths, version 1.0, 2026. https://paths.cfse.ai/methodology
Publication boundary.

This is a versioned public technical methodology. It is not a peer-reviewed paper, is not currently published on arXiv, and does not claim independent validation, empirical accuracy, or universal remediation priority.

Individual registry records retain their own sources, discoverers, evidence labels, and scorers. Methodology authorship does not imply discovery of every recorded vulnerability.