Critical
Stop active bleeding
Tier 1 covers conditions an attacker can act on now. The defining property is not severity score but reachability: the vulnerability is exposed to an untrusted network, exploitation is understood and tooled, and success grants meaningful access. These are the findings that show up in breach post-mortems.
Could an external attacker use this to gain access, escalate privilege, or take data — today, without an insider and without a chain of unlikely events?
See the full decision procedure- Remediate within
- 24–72 hours
- Escalation
- CISO and executive sponsor notified at 48 hours
- Owned by
- Security operations, with a named engineering owner per finding
- Budgeted from
- Unplanned work — Tier 1 pre-empts sprint commitments
Where CVSS fits
Findings in this tier typically score 7.0 – 10.0 — but the score is an input, never the decision. A CVSS 9.8 with no reachability does not belong in Tier 1, and a CVSS 6.5 in the CISA KEV catalog on an internet-facing host does. How Beacon relates to CVSS, EPSS and KEV.
Tier 1 findings by domain
Tier sets the deadline; domain sets the owner. Each entry links to its full definition, detection guidance, and remediation steps.
BCN-T1-NET-00124 hoursInternet-Exposed Remote Administration Services
SSH, RDP, SMB, or equivalent management protocols reachable from the public internet.
BCN-T1-NET-00224 hoursPublicly Accessible Storage and Data Services
Object storage, file shares, or managed data services readable without authentication from the internet.
BCN-T1-NET-00372 hoursNo Segmentation Between Trust Zones
A compromise of any low-value host grants unrestricted network reachability to critical systems.
BCN-T1-IAM-00124 hoursMissing MFA on Privileged Accounts
Administrative, root, or break-glass accounts authenticate with a single factor.
BCN-T1-IAM-00248 hoursExcessive Standing Privilege
Accounts hold permanent administrative rights far beyond what their role requires.
BCN-T1-IAM-00372 hoursLong-Lived Privileged Credentials
Privileged API keys, access keys, or service credentials that never expire and are not rotated.
BCN-T1-DAT-00124 hoursInjection Flaws on Internet-Facing Applications
SQL, NoSQL, OS command, or template injection reachable from an unauthenticated request.
BCN-T1-DAT-00224 hoursUnauthenticated Database Endpoints
MongoDB, Redis, Elasticsearch, or similar services accepting internet connections with no authentication.
BCN-T1-DAT-00348 hoursUnencrypted Sensitive Data at Rest
Regulated or business-critical data stored without encryption on systems exposed to compromise.
BCN-T1-PRC-00124 hoursKnown-Exploited Vulnerabilities
Unpatched CVEs with confirmed exploitation in the wild, on systems an attacker can reach.
BCN-T1-PRC-00224 hoursExposed Management and Orchestration Interfaces
Kubernetes dashboards, CI/CD consoles, hypervisor managers, or admin panels reachable from the internet.
BCN-T1-PRC-00348 hoursNo Availability Protection on Revenue-Critical Services
Business-critical services with no rate limiting, no DDoS mitigation, and no capacity isolation.