Performance
The Empirical Foundation model is designed to be trusted the same way you would trust any operational measurement system: it makes a clear, testable claim, it is evaluated against real outcomes, and it is monitored continuously as conditions change.
Empirical Foundation Model Benchmarks (Jan 1, 2026 - May 31, 2026)
The Efficiency View (Efficiency vs Coverage)
The efficiency plot compares the tradeoff between how efficiently resources are allocated against complete coverage of all observed exploited vulnerabilities. As the threshold for remediation is lowered, coverage improves, but at the cost of efficiency. Better models push up and to the right. Clearly, not all scoring systems are created equal.
The Efficiency View (Efficiency vs Coverage)
Focusing on just the top 2% of the Empirical Foundation model, 9 out of every 10 prioritized vulnerabilities showed exploitation activity after scoring (covering 75% of all exploited vulnerabilities).
The Efficiency View (Efficiency vs Coverage)
Focusing on just the top 2% of the Empirical Foundation model, 9 out of every 10 prioritized vulnerabilities showed exploitation activity after scoring (covering 75% of all exploited vulnerabilities).
The Capacity View (Coverage vs Effort)
The Coverage vs Effort curve is the most intuitive chart for practitioners because it answers, “If we can only work on X% of the backlog, how much of the observed exploitation activity do we cover?” This chart will help you understand the tradeoffs inherent in any prioritization strategy.
The Capacity View (Coverage vs Effort)
Focusing on just the top 7% of the Empirical Foundation model, remediates 90% of observed exploited vulnerabilities (within 30 days after scoring).
The Capacity View (Coverage vs Effort)
Focusing on just the top 7% of the Empirical Foundation model, remediates 90% of observed exploited vulnerabilities (within 30 days after scoring).
The Efficiency View (Efficiency vs Coverage)
The Capacity View (Coverage vs Effort)
Model Terminology
Key Term
Description
Measures the relative workload as the proportion of vulnerabilities prioritized out of all the possible CVEs: True Positives + False Positives / Everything
Measures how well our strategy covers the vulnerabilities we prioritized from all vulnerabilities that show exploitation activity (False Positives are prioritized without any exploitation activity observed): True Positives / True Positives + False Positives
Measures how accurately our strategy focuses on vulnerabilities that have exploitation activity (False Negatives are not prioritized and exploitation activity is later observed): True Positives / True Positives + False Negatives
Effort, Coverage, and Efficiency
CloseAll Published Vulns (CVEs we could prioritize)
Effort
Measures the relative workload as the proportion of vulnerabilities prioritized out of all the possible CVEs:
True Positives + False Positives / Everything
Coverage
Measures how well our strategy covers the vulnerabilities we prioritized from all vulnerabilities that show exploitation activity (False Positives are prioritized without any exploitation activity observed):
True Positives / True Positives + False Positives
Efficiency
Measures how accurately our strategy focuses on vulnerabilities that have exploitation activity (False Negatives are not prioritized and exploitation activity is later observed):
True Positives / True Positives + False Negatives