One way to categorize
every security finding
Your scanners do not have a detection problem. They have a prioritization problem. Beacon sorts any finding — from any tool — into three tiers with a fixed decision procedure, so that everyone classifying gets the same answer.
Four questions, asked in order
Stop at the first that returns yes. The order is the method — it is what makes two analysts reach the same tier for the same finding.
- 1
Is it reachable by an untrusted party right now?
If no, it is not Tier 1 — whatever the CVSS score says.
- 2
Does exploiting it grant access, privilege, or data in one step?
Yes to both → Tier 1. Fix within 24–72 hours.
- 3
Would a named auditor or regulator record it as a deficiency?
Yes → Tier 2. Fix within 30 days.
- 4
Does fixing it reduce future Tier 1 and Tier 2 findings?
Yes → Tier 3. Fix within 90 days, or defer on the record.
Severity scores are not a prioritization strategy
Sorting a backlog by CVSS treats a vulnerability on an isolated internal host as equivalent to the same vulnerability on a public endpoint. The evidence is that this barely outperforms working the list at random — which is why Beacon asks about reachability before it asks about anything else.
Every figure on this site links to a public primary source. See all 7 sources.
Three tiers, because there are three responses
A five-level severity scale fails because its middle levels carry no decision. Each Beacon tier corresponds to a different deadline, a different owner, and a different budget.
Stop active bleeding
Could an external attacker use this to gain access, escalate privilege, or take data — today, without an insider and without a chain of unlikely events?
Maintain the license to operate
Would a named auditor, regulator, or contractual counterparty record this as a deficiency?
Reduce the rate at which the first two tiers refill
Does fixing this reduce the number or severity of future Tier 1 and Tier 2 findings?
Findings with permanent identities
A standard needs stable references. Every finding class carries an identifier like BCN-T1-NET-001 that is never reused and never renumbered — so a citation in a penetration test report still resolves years later.
Each entry gives the definition, the rationale for its tier, how to detect it, ordered remediation steps, the test that proves the fix, and mappings to 42 MITRE ATT&CK techniques plus PCI DSS, HIPAA, GDPR, SOC 2 and ISO 27001.
It does not replace CVSS, EPSS or KEV
Those systems score severity, predict exploitation, and confirm it. None of them names an owner or a deadline, and none covers the misconfigurations and identity gaps that have no CVE at all. Beacon consumes them as inputs and supplies the layer above.
The full comparisonClassifying a backlog takes a few days
Changing what the organization does about it takes a quarter. The adoption guide covers both, including the exception process and the six metrics worth reporting.