Each sphere is a real point in 3D risk space: height (Y) is the exploitation-likelihood signal (EPSS-style, 0–100), horizontal position (X) is raw CVSS severity (0–10). Both organizations face the same 20-item backlog and the same patching capacity per cycle — only their prioritization rule differs.
- Org A (left) patches strictly by raw CVSS severity, highest first, every cycle.
- Org B (right) patches by the EPSS-style exploitation-likelihood height first, falling back to CVSS only as a tiebreaker.
- A sphere ringed gold is under confirmed active attack in the wild. If it's left unpatched (still floating) while active, each cycle carries a chance of a breach — its beacon flashes red.
- Drag to orbit, scroll/pinch to zoom. Watch which strategy clears the tall (high-EPSS) spheres faster.