Severity and Exploitability Analysis of Security Vulnerabilities in the Public Sector - Lima, João C. C.; Rodrigues, Lyedson S.; Araújo, Ramon S.; Pinheiro, Davi C.; Gomes, Rafael L.; Rodrigues, Emanuel B.; Andrade, Rossana M. C.; Silva, Clenival L.; Bentes, Daniel C.; Cialdini, Alexandre S. (Companion Proceedings of the Brazilian Symposium on Cybersecurity (SBSeg); 2025: Companion Proceedings of the 25th Brazilian Symposium on CybersecurityDO - 10.5753/sbseg_estendido.2025.12672, 2025)
The increasing sophistication of cyber threats poses challenges to the protection of public services and infrastructure, especially in heterogeneous environments. Simply detecting vulnerabilities is not enough: it is necessary to understand them in the context of the organization and prioritize remediation intelligently. This paper presents a systematic approach to vulnerability analysis based on vulnerability severity and exploitability. The methodology includes asset mapping, vulnerability scanning, CVSS and EPSS classification, and analysis between technical attributes and risks. The data were analyzed based on variables such as service ports, operating systems, severity of failures, and probability of exploitation, allowing the identification of exposure patterns and the definition of priorities. The results show that the integration of metrics and context significantly improves the effectiveness of vulnerability management in public institutions.