One workspace-tailored score: how much of the KEV that matters to you your SIEM can detect right now — weighted by EPSS, CVSS, ransomware use, public exploits and CISA due dates, and trended week over week.
What it measures
Threat Readiness (/threat-readiness) is the tailored rollup of Talon Threat, scored against the active workspace's SIEM evidence (with no workspace selected, against every workspace you can access). Rather than scoring the whole CISA KEV catalogue, it first filters to the CVEs relevant to you, then reports how much of that subset you can detect, weighted by real-world risk.
Relevance comes from your Threat Profile: a CVE counts when its vendor, product or name matches something the profile says you run. The workspace uses its own profile, or the organisation default it inherits. Until one of them names at least one key application, operating system or cloud platform, the page asks you to complete a profile instead of scoring anything.
Priority-weighted, not a flat count
The score is not "rules ÷ CVEs". A CVE with high EPSS, high CVSS and known ransomware use carries most of the weight, so closing it moves the number more than covering ten low-risk entries.
The headline cards.Readiness score (0–100) with its change this week, and the counts of Live, Ready and No telemetry / uncovered CVEs.
Priority buckets. Every relevant CVE is also given a bucket — highest (priority ≥0.8), high (≥0.6), medium (≥0.4), low (≥0.2) or lowest. Coverage answers "can we detect it?"; the bucket answers "how much does it matter?". The Prioritized threats table lists up to 100 relevant CVEs, highest priority first, and filters by bucket and by coverage state.
Pin a priority. Admins see a Pin column on each row (Auto / highest / high / medium / low / lowest). A pin replaces the computed bucket and flows through the score and ordering like a computed priority. It is stored on the active workspace's Threat Profile, so a workspace must be selected.
SSVC tier. Each CVE's detail shows a CISA SSVC-style decision. Every KEV CVE is already exploited; Talon treats it as automatable when EPSS is at least 0.5 or a public exploit exists, and as total impact when CVSS is at least 9 or it is ransomware-linked. Both give Act, one gives Attend, EPSS of at least 0.1 gives Track*, and anything else Track.
Threat actors. A separate panel scores up to five ATT&CK groups relevant to the profile's sector and regions, plus your pinned priority actors: how many of each group's techniques your SIEM has the data to detect, worst-covered first. Actors fold into the same score at a flat weight.
Gap age. An uncovered or blind CVE shows how long it has been open (for example "open 14d"). Gap ages are recorded by Talon Claw's scan, so they appear only when Claw is enabled for the organisation and a single workspace is selected.
Talon Threat → Threat Readiness
The readiness score with its week-over-week trend, the priority and coverage filters, and (for admins) the per-row Pin selector — leave it on Auto to keep the computed bucket, or pin an override.
The exact weights
Per-CVE priority is 0.5 × EPSS + 0.35 × (CVSS ÷ 10) + 0.1 if used in ransomware + 0.08 if a public exploit exists + a CISA due-date bump (+0.05 once the due date has passed, +0.03 within 14 days), capped to [0,1]. Until the NVD has scored a CVE, its CVSS is taken from its severity (critical 9.5, high 7.5, medium 5, low 2, unknown 5). A pinned bucket uses a fixed priority of 0.9, 0.7, 0.5, 0.3 or 0.1. The score is 100 × Σ(priority × credit) ÷ Σ priority, where live earns full credit, ready half, and blind and uncovered none; each threat actor adds its covered fraction at a weight of 0.7.
How the trend is measured
Opening the page records a snapshot of the score (at most one every 18 hours unless the score changes). The trend is the current score minus the oldest snapshot from the last seven days, and shows only once that baseline is at least 18 hours old.
The four coverage states
Every relevant CVE resolves to exactly one of four states. The rule that matters: blind is never counted as covered, so a rule that cannot run for lack of telemetry never inflates the score.
live
A workspace detection that names the CVE is deployed — full credit. The action column reads Detecting.
ready
A library rule about the CVE can run on your SIEM now (its sourcetypes and CIM data models are present), but you have not deployed a detection for it — half credit. Action: Deploy rule, which opens that rule in the Forge library.
blind
A library rule names the CVE, but your SIEM lacks the data it needs. Shown as No telemetry; no credit. Action: Onboard data, which opens Talon Connect.
uncovered
No deployed detection, and no library rule names the CVE. No credit. Action: Author detection, which opens the CVE on Threat Intelligence.
Why blind matters
Distinguishing blind from ready is the point of the page. A rule you cannot run is a data problem, not a detection problem, and counting it would be exactly the false confidence Readiness exists to prevent.
Improving readiness
The score tells you where to spend effort, and which kind of effort each gap needs.
1
Set a Threat Profile so the relevant subset reflects the applications and platforms you actually run. Readiness needs one (the workspace's own, or the organisation default) and prompts for it until it is set.
2
Work the highest-priority ready CVEs first: Deploy rule turns half credit into full live credit.
3
For uncovered CVEs, author a detection in Forge against the mapped ATT&CK technique.
4
For blind CVEs, onboard the missing sourcetype or CIM data. The CVE's detail lists what is missing; another rule will not help until the telemetry exists.
5
Watch the trend: the week-over-week change confirms whether the work is moving priority-weighted coverage.