The Death Star Had Thousands of Weaknesses. One Mattered.
Our ebook, Mending the Broken Cyber Defense Chain, argues that a defense program is really three links that mostly don’t connect: what’s coming at you, how exposed you actually are, and what it costs the business if it lands. Last time we took on the first link. This time it’s the other two, and I’m going to do it with a space station you may have heard of.
Vulnerability prioritization should be a four-stage funnel
Prioritizing vulnerabilities should work as a funnel with four stages. Start with everything your scanners flag. Narrow it to the weaknesses attackers are using, or are about to use. Narrow it again to the ones your controls don’t already stop. Finish with the few that would cost the business real money. Most programs don’t run it that way today. They patch in severity order, and attackers, who do run the funnel on you, notice. That’s the lesson of the Death Star, and the reason patching faster isn’t a strategy.
Patching faster loses to volume, and severity is a poor guide
Ask most security teams how they handle the flood of vulnerabilities and you’ll get the same answer: patch faster, worst CVSS score first. Fair enough. Severity scores are the shared language between security, IT and audit, SLAs are easy to measure, and for years the gap between disclosure and exploitation was wide enough that speed worked.
It isn’t working now. Verizon DBIR 2026 found that only 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% the prior year, with 58% partially remediated and 16% unaddressed. Read that again. That’s the list of vulnerabilities already known to be exploited, the ones with a government-maintained neon sign over them, and teams still can’t clear it. AI is making it faster to turn a disclosed flaw into a working exploit, so the volume only goes up from here.
Here’s the problem with a severity score: it describes a flaw in a vacuum. It doesn’t know who’s about to use it, what’s already in the way, or what it would cost you. The math changed, so the doctrine has to.
A quick refresher, in case it’s been a while
Star Wars: A New Hope is about a very large weapon and some very small ships. The Empire has built the Death Star, a planet-destroying battle station, and has just used it on Alderaan. Princess Leia hides the station’s stolen plans in a droid, and the droid (with some help from a farm boy, a smuggler and a Wookiee) gets them to the Rebel base on Yavin. There, General Dodonna studies the plans, finds a weakness, and briefs the pilots on it. Luke Skywalker and the other Rebel pilots take a shot at it. The Empire, for its part, stays confident for a remarkably long time that none of this can matter.
Keep that last part in mind. It’s more or less the whole post.
Stage one: every vulnerability, sorted by a number that doesn’t know you
The first stage of the funnel is the full list, and a severity-sorted list assumes every weakness belongs to one front. The Death Star shows where that assumption leads.
That’s no moon, as Obi-Wan put it, and it’s also an enormous list of weaknesses: every vent, port, hangar and trench, any of which an attacker might go after. And here’s what I love about it: the Empire didn’t build it carelessly. It built it for a specific kind of fight, a direct, large-scale assault, the kind of attack you ring a station with turbolasers to stop. That was the design assumption.
Your list works the same way. Every CVE and finding your scanners flag goes into one queue, and the queue gets sorted by a number that knows nothing about your environment. That’s the same assumption in spreadsheet form: treat every weakness as part of one front, defend it broadly, work from the top down. Attackers don’t attack the broad front. They pick. So the first useful question isn’t how severe something is. It’s which of these someone is actually coming for.
Stage two: early warning tells you what attackers are planning, not just what they have
Early warning narrows a vulnerability list to the weaknesses attackers are using, or are about to use. The Empire never really had any.
Whoa, wait, back up. Didn’t they know the Rebels had the plans? They did. Admiral Motti even brushes it off: any attack by the Rebels, he says, would be “a useless gesture, no matter what technical data they’ve obtained.” But knowing your adversary has your schematics isn’t early warning. That’s a fact about capability. It says nothing about what they’re planning to do with it.
When a specific warning finally does arrive, it comes mid-battle. An officer tells Tarkin, “We’ve analyzed their attack, sir, and there is a danger.” Tarkin’s reply is the best brush-off in cinema: “Evacuate? In our moment of triumph? I think you overestimate their chances.” Specific, yes. Early, no. And ignored anyway.
That’s the gap early warning fills, and it has to be two things at once: specific enough to act on and early enough to matter. Of everything on your list, which weaknesses are being weaponized, or are about to be, by someone who can reach you? Waiting for the advisory means waiting too long. CrowdStrike 2026 Global Threat Report found that 42% of vulnerabilities were exploited before public disclosure in 2025. Dataminr alerted customers to ConnectWise ScreenConnect exploitation 19 days before CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog, and 18 days before public proof-of-concept publication (Dataminr proprietary analysis, 2024).
Stage three: a control only counts if it stops the technique being used
A control only reduces risk if it stops the technique the attacker actually uses. The Death Star’s defenses were designed against a direct, large-scale assault, and the Rebel fighters were so small they slipped through the turbolasers. General Dodonna says as much in the briefing: “The Empire doesn’t consider a small one-man fighter to be any threat, or they’d have a tighter defense.” The exhaust shaft was shielded too, but the shield was built to stop blaster fire, and the Rebels showed up with proton torpedoes.
Both defenses existed. On paper, both covered the weakness. Neither stopped the technique being used. (Check the diagram all you like. The diagram was never the problem.)
Your environment has the same problem in a less cinematic form. Picture a CVSS 9.8 sitting behind a compensating control that’s enforcing, and a CVSS 6.5 with nothing in front of it. A severity sort puts the 9.8 first. The funnel puts the 6.5 first, if someone’s exploiting it. And if the 9.8’s WAF turns out to be in log-only mode, the 9.8 is back on top, which is exactly the thing a diagram can’t tell you. The fix is to measure controls against the MITRE ATT&CK techniques adversaries actually use, from live telemetry, so that “covered” means evidenced instead of assumed.
Stage four: material means whatever would cost real money
A vulnerability is material when exploiting it would cost the business real money. On the Death Star, one precise hit on a two-meter target started a chain reaction that destroyed the station. Every other weakness on it would have been a scorched panel. This one ended it.
Same kind of weakness, wildly different cost, depending on what it’s connected to. A vulnerability on a test server is trivia. The same vulnerability on the system that processes your revenue is a station-killer. The way to tell them apart is to know what each asset does for the business, and to state the answer in dollars and likelihood, which is the language a CFO or a board will act on. A heatmap isn’t. Many programs still can’t get there: 41% of CISOs admit they cannot correlate ROI to risk mitigation and remediation activities (Splunk CISO Report 2026).
Figure 1. As the list narrows, each surviving exposure carries its early-warning signal, its control coverage and its dollar impact.
The Rebels ran the funnel on the Empire, and you can run it first
Put the two funnels next to each other and the Rebels’ advantage is obvious. They ran theirs. The Empire never ran its own.
All vulnerabilities
Thousands of weaknesses, built for a large, direct assault
Every flagged CVE, sorted by a score that doesn’t know you
Early warning
The Empire knew the Rebels had the plans, not what they were planning. The one specific warning came mid-attack, and Tarkin waved it off
Signal that a weakness is being weaponized, before the advisory
Uncompensated
Defenses built for the wrong attack, and a shield that stops blaster fire, not torpedoes
Controls on the diagram that don’t stop the technique actually used
Material
One hit starts a chain reaction
The few findings that would cost real money, traced to the asset
Gartner® makes a related prediction: “By 2028, 60% of organizations with mature CTEM programs will use threat-informed attack-path validation to decide which exposures to fix, fund, defer or accept.” (Gartner, Strengthen CTEM With Threat-Informed Defense Effectiveness)
Anyone can draw the funnel. Running it is the hard part.
You can sketch this funnel on a whiteboard in about five minutes, which is more or less what the last few sections just did. Running it continuously, against a real environment with thousands of findings, is a different job. It takes three things that are hard to assemble and harder to build yourself.
The first is early signal. Early warning only works if you’re watching enough places, early enough, that the first sign of a weapon in the making crosses your desk. Dataminr collects across 1.3 million sources, and PTEM includes Dataminr Threat Intelligence for Exposure, built in, so the early-warning signal comes from that collection. The second is control truth: connecting to the tools you already run (100+ integrations across identity, devices, networks, applications and workloads, and data) and reading what they’re doing, not what the policy says they should be doing. The third is the loss model. Turning a CVE into a probable dollar figure takes a deep base of real losses and models built on top of it. PTEM’s are built on 150,000+ vetted global loss events, from sources like SEC disclosures, insurance claims and breach intelligence.
A model can read a CVE and tell you what it does. It can’t tell you what that class of event has cost real organizations, or that your WAF is in log-only mode on a Tuesday. That’s the difference between a clever prompt and a funnel you can take to the board.
None of this is magic, either. A funnel shrinks the queue. It doesn’t delete the rest, and it’s only as good as what it can see. If your endpoint tooling covers 80% of your endpoints, you get 80% of the picture, which is worth knowing early.
Where Dataminr for Cyber Defense fits
Predictive Threat Exposure Management (PTEM) from Dataminr for Cyber Defense is built on those three things. It takes early-warning signal from our collection, reads control effectiveness from live telemetry, and puts what’s left in dollars, traced down to the asset, so the person who owns the system and the person who owns the budget are looking at the same ranked list. It ranks by what’s being weaponized, instead of by a public severity score.
Try the funnel on your last patch cycle
Here’s a test you can run this week. Take the top ten items from your last patch cycle and answer four questions for each. Did anyone warn you before the advisory landed? Was something already covering it, and do you know that from evidence or from the diagram? What would it have cost? And why did you fix this one first? Count how many you can answer without opening four other tools. Whoever ranks your queue, a person or a product, should be able to show you why number one is number one in those terms.
If you want the longer version of how threat, exposure and business impact come apart, and what it takes to reconnect them, that’s the whole subject of Mending the Broken Cyber Defense Chain.
The Rebels ran the funnel. The Empire had the weaknesses, a late warning and a lot of confidence, and never ran it on itself. Run it first. And maybe cover the exhaust port.
Gartner® is a trademark of Gartner, Inc. and/or its affiliates.
Predictive Threat Exposure Management
This solution sheet covers the prioritization view inside the Dataminr for Cyber Defense suite, its key benefits, and the capabilities inside PTEM: intel-driven risk prioritization, automated attack path modeling, MITRE-level financial modeling, and Continuous Control Monitoring.
Learn More About PTEM
