Changing from Probability to Prioritization Method in Risk Measurement

### Overview In this talk, Glauco Sampaio, Chief Information Security Officer at Brazilian payment systems company Cielo, discusses how the company transitioned away from traditional vulnerability scoring and probability models toward a context-driven prioritization framework. Faced with thousands of vulnerability findings from scans, penetration tests, war games, threat intelligence, and pipeline code scanning, technical and product teams were overwhelmed by standard 30-day remediation mandates based purely on CVSS. To address this, Cielo aligned cybersecurity with product risk and business appetite by adopting Protection Level Agreements (PLAs), moving from static reports to a dynamic, prioritized risk management model.

### Key Topics - **Reframing Security as Product Risk**: Shifting the responsibility of remediation to product and technical owners rather than treating security as purely a cybersecurity team problem. - **Protection Level Agreements (PLAs)**: Introducing Gartner's concept of PLAs (analogous to SLAs) to establish an agreed baseline of protection aligned with organizational risk appetite and budget. - **Deprecating Probability**: Abandoning traditional probability calculations (e.g., dismissing low-likelihood edge cases like 0.0001% that could still cause severe business impact) in favor of asset criticality and exposure. - **Culture and Collaboration**: Partnering with business stakeholders and "security champions" across product and infrastructure teams rather than imposing rigid, top-down mandates.

### Technical Details Cielo established a five-level classification model complemented by dynamic modifiers to determine remediation urgency: 1. **Product / Asset Criticality**: Distinguishing core transaction and revenue-generating systems from lower-impact assets (e.g., public marketing sites). 2. **Level of Exposure**: Assessing whether a system is externally accessible via the Internet or isolated internally via microsegmentation. 3. **Access Control Level**: Factoring in authentication requirements and whether privileged internal access is required to reach a flaw. 4. **Public Exploitation**: Checking whether active public exploits exist for the vulnerability. 5. **CVSS Severity**: Utilizing CVSS ratings as an input rather than the sole driver of remediation timelines.

To reflect internal controls, the framework applies **positive modifiers** (e.g., web application firewalls, virtual patching, workarounds, or active monitoring architecture that grant extended remediation windows) and **negative modifiers** (e.g., regulatory compliance mandates like PCI DSS requiring 30-day fixes, or real-time threat intelligence confirming active exploitation). In practice, this narrowed a backlog of 8,000 high/critical issues down to 35 immediately exploitable, externally facing issues requiring urgent "war room" remediation, while the remainder were prioritized into standard team backlogs.

During implementation, Cielo managed these vulnerability databases using Microsoft Excel, Power BI, and Power Apps before publishing official dashboards to their GRC system. Furthermore, because Cielo does not accept permanent risk, unaddressed vulnerabilities without valid justification carry financial penalties affecting annual bonuses.

### Takeaways - **Start with Champions**: Begin rollout with supportive product and infrastructure teams who already implement secure architectures to demonstrate clear benefits (such as extended remediation timelines) before expanding company-wide. - **Treat Risk as a Movie, Not a Picture**: Integrate real-time threat intelligence and incident response data so vulnerability prioritization adapts as threat landscapes change. - **Formalize Governance**: Update internal policies, involve auditors and risk teams early, and embed security remediation allocations directly into regular engineering backlogs.