A security finding, on its own, is a sentence in a scanner's vocabulary. It names a weakness, attaches a severity, and points at a file or a host. What it does not tell you is whether fixing it protects a dollar of enterprise value or a dollar of nothing. That gap is the entire problem this post is about, and closing it is the path Valty is built to walk: take a raw finding, map it to the asset and the revenue it exposes, price that exposure as EBITDA-at-risk, rank it against every other open item by EBITDA recovered per dollar of remediation, fund the work, and then prove the work closed. The deliverable at the end of that path is not a score. It is a funded action and a piece of evidence a board can read.
Where most programs stop
Start with where most programs stop. CVSS scores a vulnerability in the abstract: how exploitable it is and how much technical damage it could do to a generic target. That is a legitimate and necessary input, and every scanner speaks it. But CVSS deliberately holds the asset constant at 'generic,' which means it cannot distinguish a critical flaw on a forgotten staging box from a moderate flaw on the system that runs your billing. A backlog sorted by CVSS will put a 9.8 on a synthetic-data test server above a 6.1 broken-access-control issue on the checkout service that processes every dollar of online revenue and is reachable from the internet. Both scores are correct. The ordering is wrong, because severity has no idea what either asset is worth. Severity tells you how bad a thing is; it cannot tell you what to fix first.
The chain from finding to dollars
Take that checkout finding as the worked example and follow it the whole way. The scanner emits a SARIF result naming a repository and a code path. The first link in the chain is finding-to-asset: resolve that repository to the logical capability the business actually recognizes, 'the payments service,' rather than 'repo seventeen.' The second link is asset-to-value: that capability carries, say, a meaningful share of annual online revenue, holds a store of customer PII, and sits under a contractual uptime commitment and a regulatory obligation. The third link is value-to-loss: if this access-control flaw were exploited, what is the plausible range of dollar loss given the records it exposes, the downtime it could cause, the breach-notification and regulatory costs that follow, and the revenue interruption while it is contained. Each link is an honest engineering join, not a magic number.
Model the uncertainty, don't hide it
None of those links is precise, and the integrity of the method depends on not pretending otherwise. Asset value is an estimate. Breach cost is a distribution, not a point. Exploit likelihood is a judgment informed by exposure and exploit availability, not a measured frequency. The wrong response to that uncertainty is to retreat to CVSS because a single integer feels more objective. The right response is to model the uncertainty explicitly, which is what FAIR-aligned Monte Carlo is for. Instead of asserting one loss figure for the checkout finding, you express each input as a range, the exposed record count, the probable cost per record, the likelihood the flaw is reached and used, the downtime hours, and you run the simulation many thousands of times. The output is not a number but a band: a P10 low case, a base case, and a P90 high case. That band is the EBITDA-at-risk this single finding carries, and a band is precisely the shape a CFO or an investment committee can reason about, because it shows both the expected impact and the tail.
The bridge from technical finding to EBITDA-at-risk has to stay challengeable, or it is just a more elaborate way to be wrong with confidence. Every figure the model produces carries its assumptions on its face: which revenue number was used, where it came from, what record count and per-record cost fed the breach scenario, what likelihood was assigned and why. A skeptical reader, and the buyers here are professionally skeptical, should be able to open any dollar band and see exactly which inputs move it, then change one and watch the distribution shift. That is the difference between a decision-support estimate and an oracle. The model is allowed to be uncertain; it is not allowed to be opaque. When an operating partner pushes back that the revenue attribution is too high, the answer is to adjust the input in the open, not to defend the output.
The decision metric: recovery per dollar
Now the finding is priced, but a price alone does not tell you to act. The decision metric is EBITDA recovered per dollar of remediation. For the checkout finding, estimate the reduction in expected loss if you fix it, roughly the exposed-loss band multiplied by the probability of the event it enables, then divide by what the fix actually costs in engineering hours, change risk, and tooling. Suppose the modeled loss comes back as a base case in the low millions with a long right tail, and the remediation is a few days of one team's work. The recovered exposure per dollar is enormous. Run the same calculation on the 9.8 RCE on the isolated staging box: the loss it exposes is small because there is no real data and no path to anything valuable, and the fix may mean rebuilding the environment. Its ratio is poor. The two findings that a severity list ranks in one order, the exposure ranking inverts, and the inverted order is the one you can defend.
Ranking the whole backlog on that single axis is what turns a wall of red severity badges into an investment plan. Cheap fixes on high-value, exposed assets rise to the top even at moderate severity, because they buy down a lot of exposure for very little. Expensive fixes on low-value assets fall even at critical severity, because the loss avoided does not justify the spend this quarter. Genuinely critical findings that also sit on something that matters stay near the top, because they are severe and exposed at once. The method does not fight CVSS; it gives CVSS the second dimension it was never designed to carry. The output is not 'ignore severity.' It is severity times exposure, priced, and sorted by return per dollar, which is the same axis the business uses to allocate any other capital.
Funding turns analysis into a decision
Funding is the step where this stops being analysis and becomes a decision. A ranked, priced plan is fundable in a way a severity count never is, because it speaks the language of capital allocation. The artifact that goes into the budget conversation reads: here are the findings carrying the most exposed EBITDA, here is the dollar band each represents with its confidence, here is what each fix costs, and here is the order that recovers the most EBITDA per dollar of engineering time. That changes the question a CFO or operating partner asks from 'why do you have so many criticals' to 'are we funding the fixes that buy down the most exposure,' which is the question a security program should want to be answering. The remediation gets scheduled because it has an ROI, not because it is loud.
Proving closure
Then the work happens, and the path is not finished until closure is proven. This is the part programs most often skip and the part that matters most to the buyer, because an unverified 'we fixed it' is worth nothing in a board meeting or a renewal. Proof of closure means the same chain that opened the finding now shows it shut: the finding no longer appears in the feed from the tool that raised it, the fix is tied to the change that resolved it, and the EBITDA-at-risk band that the finding contributed has come down by the modeled amount. The before-and-after is expressed in the same dollar terms the funding decision used, so the loop closes on the metric it opened on. Exposure went in at a number; it comes out at a lower number; the delta is the value the remediation actually recovered.
That closure becomes a proof pack, which is the real deliverable. It assembles the path for a specific finding or a quarter's worth of them: what was found, which asset and revenue it exposed, the loss distribution and its assumptions, the recovery-per-dollar ranking that justified the priority, the decision to fund, and the verified closure with the exposure reduction quantified. It is board-ready because it is written in financial terms and stage-honest because every estimate is labeled as decision-support, not actuarial certainty, with its method and confidence attached. A PE operating partner can drop it into a portfolio review, a CISO can put it in front of an audit committee, and a CFO can carry it into an insurance renewal, all from the same evidence, because it was built as evidence from the start rather than reconstructed afterward.
What this is, and what it is not
It is worth being explicit about what this is and is not. It is not an actuarial guarantee, and no honest version of it hands you one number and calls it your risk; every figure is a decision-support estimate carrying its assumptions so they can be challenged. It is not investment or legal advice. It does not replace your scanners, your SAST, your DAST, your cloud-posture or identity tools, or their severity logic; those remain the raw inputs and they do the detection better than any risk layer could. Valty reads the artifacts your pipeline already produces and starts its work after the finding exists: attach it to the asset, attach the asset to the dollars, model the loss as a distribution, rank by recovered exposure per dollar, and verify the close. Read-from, not replace-with, is deliberate, because the buyer already owns the detection layer and does not want another scanner.
The model is only as good as the asset-and-value mapping underneath it, and that is the unglamorous work that makes everything above it real. Tell the system every repository is equally critical and you will get a ranking no better than CVSS, because you have thrown away the one variable that made it better. The payoff comes from tagging services once with the revenue they carry, the data classes they hold, and the obligations they sit under, then keeping that current as the architecture changes. That business-context graph is reusable far beyond findings; it is what makes incident prioritization, audit scoping, and board reporting coherent too. But findings ranking is the first thing that gets sharper, and it is the cleanest demonstration of the whole path: a finding becomes a dollar band, the band becomes a priority, the priority becomes a funded fix, and the fix becomes proof. The score was never the point. The funded action and the evidence that it closed are.